Validate ASP.NET Page

Question

I want to validate my page to prevent HTML Injection attacks.

Some viruses, trojans etc. can detect and inject some code to your web site. And this can cause design of your web site can change or some malicious codes can be injected.

How can I validate my page is really my page that I create from server?

Answer 1

You can set validateRequest to true, which is default

<configuration>
  <system.web>
    <pages validateRequest="true" />
  </system.web>
</configuration>

And always encode user input:

Server.HtmlEncode("<script>unsafe</script>");

For more information:

Request Validation - Preventing Script Attacks

HtmlEncode, HtmlDecode