CODEWITHSUNDEEP
htmlasp.net-mvc
Biki
Biki

Reputation: 2588

AntiXss.HtmlEncode vs AntiXss.GetSafeHtmlFragment

Can anyone please let me know the difference between these two? AntiXss.HtmlEncode() vs AntiXss.GetSafeHtmlFragment()

Upvotes: 5

Views: 21376

Answers (3)

Brian Chavez
Brian Chavez

Reputation: 8583

HtmlEcode actually encodes tags:

AntiXss.HtmlEncode("<b>hello</b><script>");
//Output: &lt;b&gt;hello&lt;/b&gt;&lt;script&gt;

GetSafeHtmlFragment (AntiXss v4.0) returns HTML fragments with tags intact:

Sanitizer.GetSafeHtmlFragment("<b>hello2</b><script>")
//Output: <b>hello2</b>

Update

Many consider the latest version of Microsoft's AntiXSS library broken. I've started using HTML Sanitizer as a decent replacement.

Upvotes: 9

Joel
Joel

Reputation: 71

It should also be mentioned that antixss.GetSafeHtmlFragment does encode characters too. A double quote changes to &quot;. A plus sign turns into &#43; etc.

Upvotes: 7

Herc
Herc

Reputation: 51

I would also add that GetSafeHtmlFragment messes up your CSS, by ading x_ in front of styles, and removes your HTML entity encoding. It is a less than beautiful thing.

Herc

Upvotes: 5

Related Questions