Cross -Site Scripting and SQL Data Reader

[Guest]

I am using sqlDataReader for Showing data from the Data base
But if the Data from sql is having tags like <script>alert()</script> then it shows an alert box while binding

Is there any way of suppressing it this ..... ???

regard
Vineet Batt

 

[Scott Allen]

Hi Vineet:

Use HttpUtility.HtmlEncode to escape the proper characters. The
browser will render the string as text instead of interpreting a
script block. If you are looking for ways to prevent users from
getting this into your database, check out:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnaspp/html/scriptingprotection.asp
(or use ValidateRequest .net 1.1).

HTH,