How to cleanse a string

Question

How to cleanse a string

Keith Viking 20

Hi I have a message box on a site. They can enter any characters and submit the form. In Asp.Net webforms we could add decode or encode to stop malicious content from being submitted but what would the equivalent be for MVC (.Net 6) so I can clean the string before storing in a database or sending as an email? I have added the attribute [validateantiforgerytoken] to the POST method.

Karen Payne MVP 35,586 Reputation points Volunteer Moderator

2023-05-03T16:42:25.1966667+00:00

See HtmlSanitizer which is installed as an NuGet package

1 answer

Your answer

Karen Payne MVP 35,586 Reputation points Volunteer Moderator

2023-05-03T16:42:25.1966667+00:00

See HtmlSanitizer which is installed as an NuGet package

Answer 1

Bruce (SqlWork.com) 77,926 Volunteer Moderator

Proper html escape on display is preferred. But you can find html sanitization libraries if you google.

Keith Viking 20 Reputation points

2023-05-03T16:13:30.3366667+00:00

Interesting, so any benefit of a third party library over the .Net Core/6?
Bruce (SqlWork.com) 77,926 Reputation points Volunteer Moderator

2023-05-03T22:42:03.7133333+00:00

Html sanitizing is much more complex then one expects, and most solutions only handle common cases. You don't specify what you are trying to sanitize.

Do you just want text? then parse the input into a html dom and only extract the text nodes. walking the dom, you can also include know node types (say <div>,<p>,<ul><ol>, <li>, etc).

You can also use dom parsing to produce well formed html.

net 6 (nor previous versions) does not have a html parser. you need to use a nuget package.

Share via

How to cleanse a string

1 answer

Your answer