Microsoft AntiXSS - Is there a need to Decode?

Question

The HttpUtility class provides for both encoding and decoding. But, when I use the MS AntiXSS 3.1 Library I have a set of methods only for encoding, does this mean decoding can be avoided?

For example

Before applying AntiXSS:

lblName.Text = "ABC" + "<script> alert('Inject'); </script";

After applying AntiXSS:

lblName.Text = AntiXSS.HTMLEncode("ABC" + "<script> alert('Inject'); </script");

So, after applying the encoding, the HTML tags show up in my Label control.

Is this the desired outcome?

Answer 1

You can use the HttpUtility.HtmlDecode method to decode AntiXss encoded text (or any encoded text). No explicit AntiXss decode is required.