如何避免跨站点脚本 [英] How to avoid Cross Site Scripting

问题描述

我正在开发一个项目，向用户提供编辑器.

并且由于它是一个编辑器，因此我必须为该特定页面强行设置VALIDATEREQUEST = FALSE，脚本标记也可以轻松插入....

现在如何避免在此处使用跨站点脚本.

适当的答复表示赞赏.

预先表示感谢.

Hi,

I am developing a project, where i m giving a Editor to the user.

And as it is a editor, forcefully i need to set VALIDATEREQUEST = FALSE for that particular page, also scripting tags can be easily inserted....

Now how can i avoid Cross Site Scripting here.

Proper responses are appreciated.

Thanks in advance.

推荐答案

避免跨站点脚本编写的最佳方法是对所有输入字符串使用Server.HtmlEncode.

The best way to avoid cross site scripting is to use Server.HtmlEncode to all the input strings.

这篇关于如何避免跨站点脚本的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！