Menu
What security protection does HTML.Encode() afford me when I'm dealing with user input, specifically scripting problems?
528
HTML encoding ensures that text will be correctly displayed in the browser, not interpreted by the browser as HTML. For example, if a text string contains a less than sign (<) or greater than sign (>), the browser would interpret these characters as an opening or closing bracket of an HTML tag.
HTML Encoding means to convert the document that contains special characters outside the range of normal seven-bit ASCII into a standard form. The type of encoding used is sent to the server in form of header information so that it can be easily and correctly parsed by the browsers.
The htmlentities() function converts characters to HTML entities. Tip: To convert HTML entities back to characters, use the html_entity_decode() function. Tip: Use the get_html_translation_table() function to return the translation table used by htmlentities().
Please see Server.HTMLEncode:
The HTMLEncode method applies HTML encoding to a specified string. This is useful as a quick method of encoding form data and other client request data before using it in your Web application. Encoding data converts potentially unsafe characters to their HTML-encoded equivalent.
If the string to be encoded is not DBCS, HTMLEncode converts characters as follows:
- The less-than character (<) is converted to
<.- The greater-than character (>) is converted to
>.- The ampersand character (&) is converted to
&.- The double-quote character (") is converted to
".- Any ASCII code character whose code is greater-than or equal to 0x80 is converted to
&#<number>, where is the ASCII character value.
This means that if you are going to dump some data to the request stream and that data was saved to the database from a user-entered field it will prevent users from being able to say that their first name is:
<script type="text/javascript">
function doSomethingEvil() { /* ... */ }
</script>
In this example, Server.HTMLEncode would encode the <, >, and " characters leaving this:
<script type="text/javascript">
function doSomethingEvil() { /* ... */ }
</script>
which, if rendered in the browser will look like this:
<script type="text/javascript"> function doSomethingEvil() { /* ... */ } </script>
rather than actually executing.
151
it prevents XSS (cross site scripting) attacks, since if it prevents users input to turn into scripts that can be used to perform this type of attack
43
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
