ASP.NET 3.5 For Dummies®

19.9. Defanging Markup for Safety

If you want to accept HTML markup in a text box, you must disable ASP.NET's built-in defense against JavaScript attacks. (See the previous sidebar, "ASP.NET tries to protect you"). To disable the protection you change the Page directive to look like this:

<%@ Page Language="VB"  ValidateRequest="false"%>

You can ward off much of the danger of script attacks by encoding the HTML before it gets into your database. The Server object's HTMLEncode() method converts troublesome characters into their escaped format. In geekspeak, they're now entities.

Here's a little demonstration that might convince you.

1. Add an ASP.NET page named defang.aspx to your project.

2. Add a TextBox control and a Button control to the page.

3. Double-click the Button control to create a default handler for its Click event and insert the following line of code in the subroutine:

   Response.Write(TextBox1.Text)

4. Disable the protection against scripting attacks by changing the Page directive to look like the following:

   <%@ Page Language="VB"  ValidateRequest="false"%>

5. Browse to the page, type the following into the text box, and click the button:

   <script>location.href='http://kencox.ca';</script>

   You see that if the malicious script got into your database and displayed on a page, visitors could be redirected to a site of the attacker's choice.

6. Change the code used in Step 3 to the following:

   Response.Write(Server.HtmlEncode(TextBox1.Text))

7. Repeat Step 5.

   The malicious script has been defanged and ...