CODEWITHSUNDEEP
c#asp.net-mvc-3
Syed Salman Raza Zaidi
Syed Salman Raza Zaidi

Reputation: 2192

Allow and Limit some HTML characters

I have make a messaging system in which user can send messages to each other, they can also send files as attachement in message(its like simple email system). It allows users to send HTML characters and they'll render by browser, for eg if they enter

<b>Hello</b>

it'll rendered as Hello

Its working fine,however i am facing one problem if user enter 

<iframe src="anywebsite"><iframe>

theny it'll also rendered by browser.

How can i allow only some particular characters to be rendered by browser rest will display as normal text I am using Asp.net MVC3

In my model class i've add
[AllowHtml] attribute to allow HTML characters

Upvotes: 0

Views: 440

Answers (1)

Darin Dimitrov
Darin Dimitrov

Reputation: 1039398

You could use the AntiXss library:

For example:

@Html.Raw(Sanitizer.GetSafeHtmlFragment("<b>Hello</b>"))
@Html.Raw(Sanitizer.GetSafeHtmlFragment("<iframe src=\"anywebsite\"><iframe>"))

The first will render the Hello text in bold whereas the second won't render anything as it is not considered safe.

You could also checkout the AntiSamy project.

Upvotes: 2

Related Questions