Skip to main content

Allow User to input HTML in ASP.NET MVC - ValidateInput or AllowHtml

What Is Cross Site Scripting (XSS) Attack?
The Cross Site Scripting (XSS) attack is a type of injection and attackers inject your web applications using the client side scripts and malicious code into web pages.

An attacker can insert vulnerability scripts and malicious code in your web applications.

The Cross Site Scripting (XSS) attacks are common on web browsers and it carried out on websites around 84% (approximately).

How To Prevent an ASP.NET MVC Apps?
In ASP.NET MVC by default Cross Site Scripting (XSS) attack is validated and if any one of you tries to post JavaScript/HTML and other XSS attacks code in the database. It will return an error i.e.

The AllowHtml attribute is used to allow a request to sending HTML/JavaScript codes to server which be applied to a Model property to disable the validation.

The AllowHtml attribute is developed for View Model class with limited Scope and its safe and recommended solution to prevent Cross Site Scripting (XSS) attacks in ASP.NET MVC Apps.

In ASP.Net MVC Project, follow the below steps and prevent the XSS Attacks -
//Steps 1
//Add the following attribute the post action in the controller that you want to allow HTML.
[ValidateInput(false)]


//Steps 2
//AllowHtml attribute is developed for Customer View Model class.
public class CustomerViewModel
{
    [Display(Name = "Email")]
    public string Email { get; set; }

    [AllowHtml]
    public string Name { get; set; }

    [AllowHtml]
    [Display(Name = "Description")]
    public string Description { get; set; }
}

//Steps 3
//HTML View
@model PreventXSSAttacks.Models.CustomerViewModel
@{
    ViewBag.Title = "Add Customer";
}

<h2>@ViewBag.Title.</h2>

@using (Html.BeginForm("Create", "Customer", FormMethod.Post, new { @class = "form-horizontal", role = "form" }))
{
    @Html.AntiForgeryToken()
    <h4>Create a new account.</h4>
    <hr />
    @Html.ValidationSummary("", new { @class = "text-danger" })
    <div class="form-group">
        @Html.LabelFor(m => m.Email, new { @class = "col-md-2 control-label" })
        <div class="col-md-10">
            @Html.TextBoxFor(m => m.Email, new { @class = "form-control" })
        </div>
    </div>
    <div class="form-group">
        @Html.LabelFor(m => m.Name, new { @class = "col-md-2 control-label" })
        <div class="col-md-10">
            @Html.TextBoxFor(m => m.Name, new { @class = "form-control" })
        </div>
    </div>
    <div class="form-group">
        @Html.LabelFor(m => m.Description, new { @class = "col-md-2 control-label" })
        <div class="col-md-10">
            @Html.TextBoxFor(m => m.Description, new { @class = "form-control" })
        </div>
    </div>
    <div class="form-group">
        <div class="col-md-offset-2 col-md-10">
            <input type="submit" class="btn btn-default" value="Add Customer" />
        </div>
    </div>
}

//Steps 4
//Customer controller’s Action.
[ValidateAntiForgeryToken]
[ValidateInput(false)]
public ActionResult Create(CustomerViewModel customer)
{
    if (ModelState.IsValid)
    {
        StringBuilder sb = new StringBuilder();
        sb.Append(HttpUtility.HtmlEncode(customer.Description));

        sb.Replace("/&/g", "&amp;");
        sb.Replace("/</g", "&lt;");
        sb.Replace("/>/g", "&gt;");
        sb.Replace("/\"/g", "&quot;");
        sb.Replace("/\'/g", "&#39;");

        if (sb.Length > 0)
        {
            customer.Description = HttpUtility.HtmlEncode(sb.ToString());
            return _custRepot.InsertCustomer(customer);
        }
    }
    return View(customer);
}

Also, In your web.config set the validation mode –
<httpRuntime targetFramework="4.5.1" requestValidationMode="2.0" />


I hope you are enjoying with this post! Please share with you friends. Thank you so much!
By Anil Singh | Rating of this article (*****)

Popular posts from this blog

nullinjectorerror no provider for httpclient angular 17

In Angular 17 where the standalone true option is set by default, the app.config.ts file is generated in src/app/ and provideHttpClient(). We can be added to the list of providers in app.config.ts Step 1:   To provide HttpClient in a standalone app we could do this in the app.config.ts file, app.config.ts: import { ApplicationConfig } from '@angular/core'; import { provideRouter } from '@angular/router'; import { routes } from './app.routes'; import { provideClientHydration } from '@angular/platform-browser'; //This (provideHttpClient) will help us to resolve the issue  import {provideHttpClient} from '@angular/common/http'; export const appConfig: ApplicationConfig = {   providers: [ provideRouter(routes),  provideClientHydration(), provideHttpClient ()      ] }; The appConfig const is used in the main.ts file, see the code, main.ts : import { bootstrapApplication } from '@angular/platform-browser'; import { appConfig } from ...

How To convert JSON Object to String?

To convert JSON Object to String - To convert JSON Object to String in JavaScript using “JSON.stringify()”. Example – let myObject =[ 'A' , 'B' , 'C' , 'D' ] JSON . stringify ( myObject ); ü   Stayed Informed –   Object Oriented JavaScript Interview Questions I hope you are enjoying with this post! Please share with you friends!! Thank you!!!

List of Countries, Nationalities and their Code In Excel File

Download JSON file for this List - Click on JSON file    Countries List, Nationalities and Code Excel ID Country Country Code Nationality Person 1 UNITED KINGDOM GB British a Briton 2 ARGENTINA AR Argentinian an Argentinian 3 AUSTRALIA AU Australian an Australian 4 BAHAMAS BS Bahamian a Bahamian 5 BELGIUM BE Belgian a Belgian 6 BRAZIL BR Brazilian a Brazilian 7 CANADA CA Canadian a Canadian 8 CHINA CN Chinese a Chinese 9 COLOMBIA CO Colombian a Colombian 10 CUBA CU Cuban a Cuban 11 DOMINICAN REPUBLIC DO Dominican a Dominican 12 ECUADOR EC Ecuadorean an Ecuadorean 13 EL SALVA...

Encryption and Decryption Data/Password in Angular

You can use crypto.js to encrypt data. We have used 'crypto-js'.   Follow the below steps, Steps 1 –  Install CryptoJS using below NPM commands in your project directory npm install crypto-js --save npm install @types/crypto-js –save After installing both above commands it looks like  – NPM Command  1 ->   npm install crypto-js --save NPM Command  2 ->   npm install @types/crypto-js --save Steps 2  - Add the script path in “ angular.json ” file. "scripts" : [                "../node_modules/crypto-js/crypto-js.js"               ] Steps 3 –  Create a service class “ EncrDecrService ” for  encrypts and decrypts get/set methods . Import “ CryptoJS ” in the service for using  encrypt and decrypt get/set methods . import  {  Injectable  }  from ...

Angular Testing Questions and Answers | 9, 8, 7, 6

What Is Testing? The testing is a tools and techniques for a unit and integration testing Angular applications . Why Test? Tests are the best ways to prevent software bugs and defects. How to Setup Test in Angular Project? Angular CLI install everything you need to test an Angular application. This CLI command takes care of Jasmine and karma configuration for you. Run this CLI command- ng test The test file extension must be “.spec.ts” so that tooling can identify the test file. You can also unit test your app using other testing libraries and test runners. Types of Test – The all great developer knows his/her testing tools use. Understanding your tools for testing is essential before diving into writing tests. The Testing depends on your project requirements and the project cost. The types of Testing looks like - 1.       Unit Test 2.       Integration Test 3.       En...