To HTMLENCODE or not to HTMLENCODE user input on web form (asp.net vb)

Question

I have many params making up an insert form for example:

x.Parameters.AddWithValue(\"@city\", City.Text)

I had a failed xss attack on the site

Answer 1

Don't encode input. Do encode output. At some point in the future, you might decide you want to use the same data to produce PDF or a Word document (or something else), at which point you won't want it to be HTML.

When you are accepting data, it is just data.

When you are inserting data into a database, it needs to be converted to make sense for the database.

When you are inserting data into an HTML document, it needs to be converted to make sense for HTML.

… and so on.

Answer 2

I strongly recommending looking at the OWASP XSS Prevention Cheat Sheet. It helps classify the different areas of a html document you can inject into, and a recipe for how to encode your output appropriately for each location.

Know that you can't just universally trust a function like htmlEncode() and expecct it to be a magic pill for all ills. To quote from the OWASP document linked:

Why Can't I Just HTML Entity Encode Untrusted Data?

HTML entity encoding is okay for untrusted data that you put in the body of the HTML document, such as inside a tag. It even sort of works for untrusted data that goes into attributes, particularly if you're religious about using quotes around your attributes. But HTML entity encoding doesn't work if you're putting untrusted data inside a tag anywhere, or an event handler attribute like onmouseover, or inside CSS, or in a URL. So even if you use an HTML entity encoding method everywhere, you are still most likely vulnerable to XSS. You MUST use the escape syntax for the part of the HTML document you're putting untrusted data into. That's what the rules below are all about.

Take time to understand exactly how and why XSS works. Then just follow these 7 rules and you'll be safe.