.NET libraries to sanitize input?

Question

Are there any thoroughly tested .NET libraries out there to sanitize input from things like script/sql injection?

Answer 1

SQL injection and Cross-Site Scripting (a.k.a. XSS or Script Injection) are different problems.

1) SQL Injection is very easy, always use parametrized queries (SQLParameter) and try really hard to NEVER do sp_exec @query within T-SQL stored procedures. .Net parametrized queries will not protect against this second order injection.

2) XSS is more difficult to universally mitigate since there are so many places that JavaScript can be inserted into HTML documents. The recommendations to use AntiXSS for encoding user data is right on. Use this library before inserting user data into output documents. Unfortunately, if you are using ASP.Net server controls encoding all data may lead to double-encoding and display artifacts. This happens because some control properties encode data while others don't. Refer to this table to find out the properties encoded by default. Use Anti-XSS before assigning to any properties that don't encode.

Answer 2

I like to use the Microsoft AntiXSS library. It's free and pretty easy to use.

For SQL injection, I always use parameters. Again, they are easy to use and I don't like trying to escape special characters. It's a recipe for disaster if you ask me.

Answer 3

Use parameterised commands, rather than trying to sanitize strings, to guard against SQL Injection.