Should i just use html sanitizer on "rich html values"?

Question

Do i need to sanitize all string values passed to my controller or just rich html like editors?

What about input , type text fields?

<input type="text" name"test1" value="<script></script>" />


public ActionResult TestAction(string test1){ //save in db }

Answer 1

Always sanitize data being sent to the server. You don't want anyone to arbitrarily send data to your server of any type. Some HTML tags, such as <script> elements, can be harmful. You don't want the user storing JavaScript code in your content pages as it could be malicious for other users.