How to prevent our URL from Cross-site scripting (XSS)?

Question

Please suggest me the best way to stop Cross-site scripting (XSS) through URL.

For Example see below URL and after affect of this attack.

https://example.com/questions/ask.aspx?hf=15315%27%3balert("XSS")%2f%2f150

and after this an alert has been occur on browser.

enter image description here

RBT · Accepted Answer · 2021-05-17 13:30:17Z

1

For ASP.NET, you could use the System.Web.Security.AntiXssEncoder to wrap the text in HtmlEncode. This should prevent malicious actors from saving scripts to your database that would execute in a browser.

entity.SomeValue = AntiXssEncoder.HtmlEncode(model.SomeValue);

edited May 17, 2021 at 13:30

RBT

26.3k24 gold badges178 silver badges267 bronze badges

answered Oct 20, 2017 at 6:21

William

5912 gold badges10 silver badges24 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

RBT Over a year ago

For preventing XSS attack using URLs we can use AntiXssEncoder.UrlEncode(inputFromQueryString)

Jerome Anthony · Accepted Answer · 2017-10-20 05:22:35Z

0

Validate the http input request parameter, before using it as parameter or rendering in a returned page. You may be able to whitelist values for your parameter as well.

https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet

answered Oct 20, 2017 at 5:22

Jerome Anthony

8,1012 gold badges44 silver badges32 bronze badges

2 Comments

Burhan Khan Over a year ago

I am new so can you please give me simple example about related question

Jerome Anthony Over a year ago

Read through the owasp article. It has code samples and explanations

Collectives™ on Stack Overflow

How to prevent our URL from Cross-site scripting (XSS)?

2 Answers 2

1 Comment

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related