To HTMLENCODE or not to HTMLENCODE user input on web form (asp.net vb)

Question

I have many params making up an insert form for example:

x.Parameters.AddWithValue(\"@city\", City.Text)

I had a failed xss attack on the site

Answer 1

Don't encode input. Do encode output. At some point in the future, you might decide you want to use the same data to produce PDF or a Word document (or something else), at which point you won't want it to be HTML.

When you are accepting data, it is just data.

When you are inserting data into a database, it needs to be converted to make sense for the database.

When you are inserting data into an HTML document, it needs to be converted to make sense for HTML.

… and so on.