Upload File

microsoft antixss library - documentation & help · microsoft antixss library using antixss as...

  • Home
  • Documents
  • Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding
225
Microsoft AntiXSS Library Welcome to the Microsoft AntiXSS Library Cross-site scripting (XSS) attacks exploit vulnerabilities in web-based applications that fail to properly validate and/or encode input that is embedded in response data. Malicious users can then inject client-side script into response data causing the unsuspecting user's browser to execute the script code. The script code will appear to have originated from a trusted site and may be able to bypass browser protection mechanisms such as security zones. These attacks are platform-and-browser independent, and can allow malicious users to perform malicious actions such as gaining unauthorized access to client data like cookies or hijacking sessions entirely.

Upload: others

Post on 23-May-2020

15 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

WelcometotheMicrosoftAntiXSSLibrary

Cross-sitescripting(XSS)attacksexploitvulnerabilitiesinweb-basedapplicationsthatfailtoproperlyvalidateand/orencodeinputthatisembeddedinresponsedata.Malicioususerscantheninjectclient-sidescriptintoresponsedatacausingtheunsuspectinguser'sbrowsertoexecutethescriptcode.Thescriptcodewillappeartohaveoriginatedfromatrustedsiteandmaybeabletobypassbrowserprotectionmechanismssuchassecurityzones.

Theseattacksareplatform-and-browserindependent,andcanallowmalicioususerstoperformmaliciousactionssuchasgainingunauthorizedaccesstoclientdatalikecookiesorhijackingsessionsentirely.

Page 2: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso:

What'sNew/ChangeHistory

UsingAntiXSSasthedefaultASP.NETencoder(.NET4.0)

LicenseAgreement

Microsoft.Security.Application

Page 3: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

AntiXSSHelpandSource

WebProtectionLibraryHomePage

DiscussionForum

SourceCode

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com
http://wpl.codeplex.com/discussions
http://wpl.codeplex.com/SourceControl/list/changesets
http://wpl.codeplex.com/
Page 4: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

What'sNewinAntiXSS/ChangeHistory

Page 5: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

What'snewinAntiXSS4.2

MinimumRequirements

Youcannow,onceagain,usetheencoderlibrariesin.NET2.0..NET2.0,3.5and4.0havetheirownlibrariesoptimisedforeachversionoftheframework.

.NET4.0Support

The.NET4.0versionofAntiXSScomeswithaclassthatcanbeusedtosetAntiXSSasthedefaultencoderusedbyMVC,WebPagesandWebFormsapplications.

InvalidUnicodeishandleddifferently.

InvalidUnicodecharactersarenowreplacedwiththeUnicodereplacementcharacter,U+FFFD(�).PreviouslywhenencodingstringsthroughHtmlEncode,HtmlAttributeEncode,XmlEncode,XmlAttributeEncodeorCssEncodeinvalidUnicodecharacterswouldbedetectedandanexceptionthrown.

UrlPathEncodeadded.

TheencodinglibrarynowhasEncoder.UrlPathEncode(String)whichwillencodeastringforuseasthepathpartofaURL.

TheHTMLSanitizerhandlesCSSdifferently.

TheHTMLSanitizernowremovesallCSSfromthe<head>sectionofanHTMLpage.Ifa<style>tagisdiscoveredinthebodyofanHTMLpage,orinaninputfragmentthetagwillberemoved,butthecontentskept,ashappenswithotherinvalidtags.Ifthestyleattributeisdiscoveredonanelementitisremoved.

Page 6: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

What'snewinAntiXSS4.0

MinimumRequirements

TheAntiXSSLibrarynowrequires.NETFramework3.5.

ReturnValues

Ifyoupassanullasthevaluetobeencodedtheencoderwillnowreturnnull.ThepreviousbehaviorwastoreturnString.Empty.

MediumTrustSupport

TheHTMLSanitizationmethods,GetSafeHtml()andGetSafeHtmlFragment()havebeenmovedtoaseparateassembly.ThisenablestheAntiXssLibraryassemblytoruninmediumtrustenvironments,acommonuserrequest.IfyouwishtousetheHtmlSanitizationlibraryyoumustnowincludetheHtmlSanitizationLibraryassembly.Thisassemblyrequiresfulltrustandtheabilitytorununsafecode.

Adjustablesafe-listingforHTML/XMLEncoding

ThesafelistforHTMLandXMLencodingisnowadjustable.TheMarkAsSafe(LowerCodeCharts,LowerMidCodeCharts,MidCodeCharts,UpperMidCodeCharts,UpperCodeCharts)methodallowstoyouchoosefromtheUnicodeCodeChartswhichlanguagesyourwebapplicationnormallyaccepts.Safe-listingalanguagecodechartleavesthedefinedcharactersintheirnativeformduringencoding,whichincreasesreadabilityintheHTML/XMLdocumentandspeedsupencoding.Certaindangerouscharacterswillalsobeencoded.ThelanguagecodechartsaredefinedintheMicrosoft.Security.Application.LowerCodeCharts,Microsoft.Security.Application.LowerMidCodeCharts,Microsoft.Security.Application.MidCodeCharts,Microsoft.Security.Application.UpperMidCodeChartsandMicrosoft.Security.Application.UpperCodeChartsenumerations.

Itissuggestedyousafelistyouracceptablelanguagesduringyourapplicationinitialization.

InvalidUnicodecharacterdetection

IfanyoftheHTML,XMLorCSSencodingmethodsencountersacharacter

Page 7: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

withacharactercodeof0xFFFEor0xFFFF,thecharactersusedtodetectbyteorderatthebeginningoffilesanInvalidUnicodeValueExceptionwillbethrown.

SurrogateCharacterSupportinHTMLandXMLencoding

SupportforsurrogatecharacterpairsforUnicodecharactersoutsidethebasicmultilingualplanehasbeenimproved.Suchcharacterpairsarenowcombinedandencodedastheir&xxxxx;value.Ifahighsurrogatepaircharacterisencounteredwhichisnotfollowedbyalowsurrogatepaircharacter,oralowsurrogatepaircharacterisencounteredwhichisnotprecededbyahighsurrogatepaircharacteranInvalidSurrogatePairExceptionisthrown.

HTML4.01NamedEntitySupport

AnewoverloadoftheHtmlEncodemethod,Encoder.HtmlEncode(String,Boolean)allowsyoutospecifyifthenamedentitiesfromtheHTML4.01specificationshouldbeusedinpreferenceto&#xxxx;encodingwhenanamedentityexists.ForexampleifuseNamedEntitiesissettotruethecopyrightentitywouldbeencodedas&copy;.

HtmlFormUrlEncode

AnewencodingtypesuitableforusinginencodingHtmlPOSTformsubmissionsisnowavailableviaEncoder.HtmlFormUrlEncode.ThisencodesaccordingtotheW3Cspecificationsforapplication/x-www-form-urlencodedMIMEtype.

LDAPEncodingchanges

TheLdapEncodefunctionhasbeendeprecatedinfavoroftwonewfunctions,Encoder.LdapFilterEncode(String)andEncoder.LdapDistinguishedNameEncode(String)

Encoder.LdapFilterEncode(String)encodesinputaccordingtoRFC4515whereunsafevaluesareconvertedto\XXwhereXXistherepresentationoftheunsafecharacter.ForexampleInput OutputParensRUs(forallyourparentheticalneeds)

ParensRUs\28forallyourparentheticalneeds\29

* \2A

Page 8: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

C:\MyFile C:\5CMyFileLučić Lu\C4\8Di\C4\87

Encoder.LdapDistinguishedNameEncode(String)encodesinputaccordingtoRFC2253whereunsafecharactersareconvertedto#XXwhereXXistherepresentationoftheunsafecharacterandthecomma,plus,quote,slash,lessthanandgreatthansignsareescapedusingslashnotation(\X).Inadditiontothisaspaceoroctothorpe(#)atthebeginningoftheinputstringis\escapedasisaspaceattheendofastring.Input Output,+\"\<> \,\+\"\\\<\>Hello \HelloHello Hello\#Hello \#HelloLučić Lu#C4#8Di#C4#87

Encoder.LdapDistinguishedNameEncode(String,Boolean,Boolean)isalsoprovidedsoyoumayturnofftheinitialorfinalcharacterescapingrules,forexampleifyouareconcatenatingtheescapeddistinguishednamefragmentintothemidstofacompletedistinguishedname.InadditiontotheRFCmandatedescapingthesafelistexcludesthecharacterslistedathttp://projects.webappsec.org/LDAP-Injection.

MarkOutput

TheabilitytomarkoutputusinganHtmlEncodeoverloadandquerystringparameterhasbeenremoved.

http://projects.webappsec.org/LDAP-Injection
Page 9: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso:

UsingAntiXSSasthedefaultASP.NETencoder(.NET4.0)

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 10: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

HowdoIuseAntiXSS?

Inthistutorial,I'llshowyouhowtheMicrosoftAnti-CrossSiteScriptingLibrarycanbeusedtoprotectusersfromCross-SiteScripting(XSS)attacks.I'llalsoshowyouaneasymethodforassessingusecasescenariosforpotentialXSSvectorsusingnothingmorethanasimpletable.

NoteCross-sitescripting(XSS)attacksexploitvulnerabilitiesinWeb-basedapplicationsthatfailtoproperlyvalidateand/orencodeinputthatisembeddedinresponsedata.Malicioususerscantheninjectclient-sidescriptintoresponsedatacausingtheunsuspectinguser'sbrowsertoexecutethescriptcode.Thescriptcodewillappeartohaveoriginatedfromatrustedsiteandmaybeabletobypassbrowserprotectionmechanismssuchassecurityzones.InadditioncertainserversidequeriessuchasLDAPlook-upscanbeinjectedinmuchthesamewayasSQLqueriescanbeinjected,changingtheresultofthequery.

Theseattacksareplatformandbrowserindependent,andcanallowmalicioususerstoperformundesiredactionssuchasgainingunauthorizedaccesstoclientdatalikecookiesorhijackingsessionsentirely.

IfyouwantmoreinformationonXSSattacks,includinginstructionsonhowtotestforit,somegoodreferencesare

HowTo:PreventCross-SiteScriptinginASP.NET

Cross-sitescripting(wikipedia)

Cross-siteScripting(XSS)(OWASP)

http://msdn.microsoft.com/en-us/library/ms998274
http://en.wikipedia.org/wiki/Cross-site_scripting
https://www.owasp.org/index.php/XSS
Page 11: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Protectinganapplication.

ToprotectanapplicationfromXSSattackswefirstneedtounderstandthevectorsthatmalicioususerscanusetoconductsuchattacks.Ideally,weshouldhavedonethisatdesigntimeusingthreatmodelling;however,wecanstilldothisonapplicationsthathavealreadybeenimplementedusingthefollowingsteps:

1. Reviewcodewhichproducesoutput.

2. Determinewhetheroutputincludesuntrustedinputparameters.

3. Determinethecontextinwhichuntrustedinputisusedasoutput.

4. Encodetheoutputappropriately.

Ifyouaren'tsureifinputistrustedornotalwayserronthesideofcautionandassumeitisnot.Examplesofcommonuntrustedinputinclude

Formfields

Querystrings

Cookiecontents

HTTPHeaders

Page 12: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

WhichencodershouldIuse?

Onceyouhavefoundcodewhichoutputstotheuseryouneedtodetermineiftheinputistrustedoruntrusted.Onceyouhavedecidedtheinputisuntrustedyoudeterminewhichencodingmethodneedstobeusedtomaketheinputsafe.Thefollowingtablewillbehelpfulindeterminingwhichencodingmethodyoumustuse.EncodingMethod Should

beusedwhen...

Example

HtmlEncode UntrustedinputisusedinHTMLoutputexceptwhenassigningtoanHTMLattribute.

<p>Hello[UntrustedInput]</p>

HtmlAttributeEncode UntrustedinputisusedinHTMLattributes.

<p>id="[UntrustedInput]"</p>

XmlEncode UntrustedinputisusedinXMLoutputexceptwhenassigningtoanXML

<name>[UntrustedInput]</name>

Page 13: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

attribute.

XmlAttributeEncode UntrustedinputisusedinXMLattributes.

<name>firstName="[UntrustedInput]"</name>

UrlEncode UntrustedinputisusedasaquerystringvalueinaURL.

<ahref="http://search.bing.com/search?q=[Untrusted-input]">ClickHere!</a>

UrlPathEncode UntrustedinputisusedaspartofapathaURL.

<ahref="http://msdn.microsoft.com/[Untrusted-input]/">ClickHere!</a>

JavaScriptEncode UntrustedinputisusedwithinaJavaScriptcontext.

<script>varsomething="[UntrustedInput]";<script>

OtherencodermethodsincludHtmlFormUrlEncodewhichisusedwhen,incode,youarebuildinganHTTPPOSTrequesttosubmittoawebsiteandLdapDistinguishedNameEncodeandLdapFilterEncodewhichencodeuntrustedinputforsafeusewhenbuildingfiltersorqueriesagainstanLDAPdatabase.

Page 14: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

UsingAntiXSS

Nowthatyou'vedeterminedwhichscenariosrequireencoding,allthatislefttodoisaddtheMicrosoftAnti-CrossSiteScriptingLibrarytoyourprojectandencodetheuntrustedinputasitisembeddedinresponsedata.Afteryou'veinstalledthelibraryyouneedtoaddareferenceintoyourproject.Todothisusethefollowingsteps:

1. RightclicktheprojectintheSolutionExplorerWindowinVisualStudio.

2. SelecttheAddReference...optionfromthecontextmenu.

3. Selectthebrowsetabandselecttheinstallationdirectory,thenaddtheAntiXSSLibrary.dllappropriateforthe.NETframeworkversionyouareusing.

IfyouhavenotchangedtheinstalldirectorythelibrarywillbeinC:\ProgramFiles\MicrosoftInformationSecurity\AntiXSSLibraryv4.2(32bitOSes)orC:\ProgramFiles(x86)\MicrosoftInformationSecurity\AntiXSSLibraryv4.2(64bitOSes).Thisfolderwillcontain3directories,oneforeachversionofthe.NETframeworkAntiXSSsupports.

Onceyou'veaddedthereferencetothelibraryyouwillneedtoadjustyourcodetousetheappropriateencoder.Todothisopenthefileswhichcontaincodethatwritesoutputthen

1. Addausingdirective;usingMicrosoft.Security.Application;

2. Changethecodewhichassignsoutput,forexamplestringName=Request.QueryString["Name"];

wouldbecomestringName=

Encoder.HtmlEncode(Request.QueryString["Name"]);

NowrebuildyourwebapplicationandforXSS.

Page 15: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso:

UsingAntiXSSasthedefaultASP.NETencoder(.NET4.0)

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 16: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

UsingAntiXSSasthedefaultASP.NETencoder

.NET4.0introducedtheabilitytoswapthedefaultencodinglibrariesfromthecore.NETframeworklibrariestoanyexternallibrarywhichimplementsSystem.Web.Util.HttpEncoder.AntiXSS4.1nowprovidesanimplementationofthisclasswhichwillallowyoutouseAntiXSSasthedefaultencoderinbothMVCandWebForms.

ToconfigureAntiXSSasthedefaultencoderyouwillneedtoensureyouhaveaddedthe.NET4.0versionofthelibrarytoyourapplication.YoumustalsoaddanencoderTypeattributetothehttpRuntimesectioninyourweb.config;<httpRuntime

encoderType="Microsoft.Security.Application.AntiXssEncoder,

AntiXssLibrary"/>

Page 17: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso:

What'sNewinAntiXSS

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 18: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

LicenseAgreement

MicrosoftPublicLicense(Ms-PL)

MicrosoftWebProtectionLibrary(http://wpl.codeplex.com)ThisworkislicensedundertheMicrosoftPublicLicense(Ms-PL)Copyright(c)2010MicrosoftCorporation

Thislicensegovernsuseoftheaccompanyingsoftware.Ifyouusethesoftware,youacceptthislicense.Ifyoudonotacceptthelicense,donotusethesoftware.

1. Definitions-Theterms"reproduce,""reproduction,""derivativeworks,"and"distribution"havethesamemeaninghereasunderU.S.copyrightlaw.A"contribution"istheoriginalsoftware,oranyadditionsorchangestothesoftware.A"contributor"isanypersonthatdistributesitscontributionunderthislicense."Licensedpatents"areacontributor'spatentclaimsthatreaddirectlyonitscontribution.

2. GrantofRights

1. CopyrightGrantSubjecttothetermsofthislicense,includingthelicenseconditionsandlimitationsinsection3,eachcontributorgrantsyouanon-exclusive,worldwide,royalty-freecopyrightlicensetoreproduceitscontribution,preparederivativeworksofitscontribution,anddistributeitscontributionoranyderivativeworksthatyoucreate.

2. PatentGrantSubjecttothetermsofthislicense,includingthelicenseconditionsandlimitationsinsection3,eachcontributorgrantsyouanon-exclusive,worldwide,royalty-freelicenseunderitslicensedpatentstomake,havemade,use,sell,offerforsale,import,and/orotherwisedisposeofitscontributioninthesoftwareorderivativeworksofthecontributioninthesoftware.

3. ConditionsandLimitations

1. NoTrademarkLicenseThislicensedoesnotgrantyourightstouse

http://wpl.codeplex.com
Page 19: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

anycontributors'name,logo,ortrademarks.

2. Ifyoubringapatentclaimagainstanycontributoroverpatentsthatyouclaimareinfringedbythesoftware,yourpatentlicensefromsuchcontributortothesoftwareendsautomatically.

3. Ifyoudistributeanyportionofthesoftware,youmustretainallcopyright,patent,trademark,andattributionnoticesthatarepresentinthesoftware.

4. Ifyoudistributeanyportionofthesoftwareinsourcecodeform,youmaydosoonlyunderthislicensebyincludingacompletecopyofthislicensewithyourdistribution.Ifyoudistributeanyportionofthesoftwareincompiledorobjectcodeform,youmayonlydosounderalicensethatcomplieswiththislicense.

5. Thesoftwareislicensed"as-is."Youbeartheriskofusingit.Thecontributorsgivenoexpresswarranties,guarantees,orconditions.Youmayhaveadditionalconsumerrightsunderyourlocallawswhichthislicensecannotchange.Totheextentpermittedunderyourlocallaws,thecontributorsexcludetheimpliedwarrantiesofmerchantability,fitnessforaparticularpurposeandnon-infringement.

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 20: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Microsoft.Security.ApplicationNamespace

TheMicrosoftAnti-CrossSiteScriptingLibraryisanencodinglibrarydesignedtohelpdevelopersprotecttheirASP.NETweb-basedapplicationsfromXSSattacks.Itdiffersfrommostencodinglibrariesinthatitusesthewhite-listingtechnique--sometimesreferredtoastheprincipleofinclusions--toprovideprotectionagainstXSSattacks.Thisapproachworksbyfirstdefiningavalidorallowablesetofcharacters,andencodesanythingoutsidethisset(invalidcharactersorpotentialattacks).Thewhite-listingapproachprovidesseveraladvantagesoverotherencodingschemes.

Page 21: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Classes

Class DescriptionEncoder Performsencodingofinputstringsto

provideprotectionagainstCross-SiteScripting(XSS)attacksandLDAPinjectionattacksinvariouscontexts.

Sanitizer SanitizesinputHTMLtomakeitsafetobedisplayedonabrowserbyremovingpotentiallydangeroustags.

UnicodeCharacterEncoder ProvidesHTMLencodingmethods.

Page 22: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Enumerations

Enumeration DescriptionLowerCodeCharts ValuesforthelowestsectionoftheUTF8

Unicodecodetables,fromU0000toU0FFF.

LowerMidCodeCharts Valuesforthelower-midsectionoftheUTF8Unicodecodetables,fromU1000toU1EFF.

MidCodeCharts ValuesforthemiddlesectionoftheUTF8Unicodecodetables,fromU1F00toU2DDF

UpperCodeCharts ValuesfortheuppersectionoftheUTF8Unicodecodetables,fromUA8E0toUFFFD

UpperMidCodeCharts ValuesfortheuppermiddlesectionoftheUTF8Unicodecodetables,fromU2DE0toUA8DF

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 23: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

EncoderClassMembersSeeAlso

PerformsencodingofinputstringstoprovideprotectionagainstCross-SiteScripting(XSS)attacksandLDAPinjectionattacksinvariouscontexts.

Namespace:Microsoft.Security.ApplicationAssembly:AntiXssLibrary40(inAntiXssLibrary40.dll)Version:4.2.0.0

Page 24: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

publicstaticclassEncoder

VisualBasic

PublicNotInheritableClassEncoder

VisualC++

publicrefclassEncoderabstractsealed

Page 25: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

RemarksThisencodinglibraryusesthePrincipleofInclusions,sometimesreferredtoas"safe-listing"toprovideprotectionagainstinjectionattacks.Withsafe-listingprotection,algorithmslookforvalidinputsandautomaticallytreateverythingoutsidethatsetasapotentialattack.Thislibrarycanbeusedasadefenseindepthapproachwithothermitigationtechniques.Itissuitableforapplicationswithhighsecurityrequirements.

Page 26: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

InheritanceHierarchySystem.ObjectMicrosoft.Security.Application.Encoder

http://msdn2.microsoft.com/en-us/library/e5kfa45b
Page 27: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

EncoderMembersMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 28: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

EncoderMembersEncoderClassMethodsSeeAlso

TheEncodertypeexposesthefollowingmembers.

Page 29: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Methods

Name DescriptionCssEncode Encodesthespecified

stringforuseinCascadingStyleSheet(CSS)attributes.Thereturnvaluefromthisfunctionisexpectedtobeusedinbuildinganattributestring.CSSstringattributesshouldbequotedvalues.

HtmlAttributeEncode EncodesaninputstringforuseinanHTMLattribute.

HtmlEncode(String) EncodesinputstringsforuseinHTML.

HtmlEncode(String,Boolean) EncodesinputstringsforuseinHTML.

HtmlFormUrlEncode(String) Encodesinputstringsforuseinapplication/x-www-form-urlencodedformsubmissions.

HtmlFormUrlEncode(String,Int32) Encodesinputstringsforuseinapplication/x-www-form-urlencodedformsubmissions.

HtmlFormUrlEncode(String,Encoding) Encodesinputstringsforuseinapplication/x-www-form-urlencodedformsubmissions.

JavaScriptEncode(String) EncodesinputstringsforuseinJavaScript.

JavaScriptEncode(String,Boolean) EncodesinputstringsforuseinJavaScript.

Page 30: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

LdapDistinguishedNameEncode(String) EncodesinputstringsforuseasavalueinLightweightDirectoryAccessProtocol(LDAP)DNs.

LdapDistinguishedNameEncode(String,Boolean,Boolean)

EncodesinputstringsforuseasavalueinLightweightDirectoryAccessProtocol(LDAP)DNs.

LdapEncode Obsolete.EncodesinputstringstobeusedasavalueinLightweightDirectoryAccessProtocol(LDAP)searchqueries.

LdapFilterEncode EncodesinputstringsforuseasavalueinLightweightDirectoryAccessProtocol(LDAP)filterqueries.

UrlEncode(String) Encodesinputstringsforuseinuniversalresourcelocators(URLs).

UrlEncode(String,Int32) Encodesinputstringsforuseinuniversalresourcelocators(URLs).

UrlEncode(String,Encoding) Encodesinputstringsforuseinuniversalresourcelocators(URLs).

UrlPathEncode URL-encodesthepathsectionofaURLstringandreturnstheencodedstring.

VisualBasicScriptEncode EncodesinputstringsforuseinVisualBasicScript.

XmlAttributeEncode Encodesinputstringsfor

Page 31: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

useinXMLattributes.XmlEncode Encodesinputstringsfor

useinXML.

Page 32: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

EncoderClassMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 33: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

EncoderMethodsEncoderClassSeeAlso

TheEncodertypeexposesthefollowingmembers.

Page 34: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Methods

Name DescriptionCssEncode Encodesthespecified

stringforuseinCascadingStyleSheet(CSS)attributes.Thereturnvaluefromthisfunctionisexpectedtobeusedinbuildinganattributestring.CSSstringattributesshouldbequotedvalues.

HtmlAttributeEncode EncodesaninputstringforuseinanHTMLattribute.

HtmlEncode(String) EncodesinputstringsforuseinHTML.

HtmlEncode(String,Boolean) EncodesinputstringsforuseinHTML.

HtmlFormUrlEncode(String) Encodesinputstringsforuseinapplication/x-www-form-urlencodedformsubmissions.

HtmlFormUrlEncode(String,Int32) Encodesinputstringsforuseinapplication/x-www-form-urlencodedformsubmissions.

HtmlFormUrlEncode(String,Encoding) Encodesinputstringsforuseinapplication/x-www-form-urlencodedformsubmissions.

JavaScriptEncode(String) EncodesinputstringsforuseinJavaScript.

JavaScriptEncode(String,Boolean) EncodesinputstringsforuseinJavaScript.

Page 35: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

LdapDistinguishedNameEncode(String) EncodesinputstringsforuseasavalueinLightweightDirectoryAccessProtocol(LDAP)DNs.

LdapDistinguishedNameEncode(String,Boolean,Boolean)

EncodesinputstringsforuseasavalueinLightweightDirectoryAccessProtocol(LDAP)DNs.

LdapEncode Obsolete.EncodesinputstringstobeusedasavalueinLightweightDirectoryAccessProtocol(LDAP)searchqueries.

LdapFilterEncode EncodesinputstringsforuseasavalueinLightweightDirectoryAccessProtocol(LDAP)filterqueries.

UrlEncode(String) Encodesinputstringsforuseinuniversalresourcelocators(URLs).

UrlEncode(String,Int32) Encodesinputstringsforuseinuniversalresourcelocators(URLs).

UrlEncode(String,Encoding) Encodesinputstringsforuseinuniversalresourcelocators(URLs).

UrlPathEncode URL-encodesthepathsectionofaURLstringandreturnstheencodedstring.

VisualBasicScriptEncode EncodesinputstringsforuseinVisualBasicScript.

XmlAttributeEncode Encodesinputstringsfor

Page 36: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

useinXMLattributes.XmlEncode Encodesinputstringsfor

useinXML.

Page 37: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

EncoderClassMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 38: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Encoder.CssEncodeMethodEncoderClassSeeAlso

EncodesthespecifiedstringforuseinCascadingStyleSheet(CSS)attributes.Thereturnvaluefromthisfunctionisexpectedtobeusedinbuildinganattributestring.CSSstringattributesshouldbequotedvalues.

Namespace:Microsoft.Security.ApplicationAssembly:AntiXssLibrary40(inAntiXssLibrary40.dll)Version:4.2.0.0

Page 39: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

publicstaticstringCssEncode(

stringinput

)

VisualBasic

PublicSharedFunctionCssEncode(_

inputAsString_

)AsString

VisualC++

public:

staticString^CssEncode(

String^input

)

ParametersinputType:System.StringStringtobeencoded.

ReturnValueEncodedstringforuseinCSSelementvalues.

http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
Page 40: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

RemarksThismethodencodesallcharactersexceptthosethatareinthesafelist.Thefollowingtableliststhedefaultsafecharacters.UnicodeCodeChart Characters(s) DescriptionC0ControlsandBasicLatin A-Z UppercasealphabeticlettersC0ControlsandBasicLatin a-z LowercasealphabeticlettersC0ControlsandBasicLatin 0-9 Numbers

TheCSScharacterescapesequenceconsistsofabackslashcharacter(\)followedbyuptosixhexadecimaldigitsthatrepresentacharactercodefromtheISO10646standard.(TheISO10646standardiseffectivelyequivalenttoUnicode.)Anycharacterotherthanahexadecimaldigitterminatestheescapesequence.Ifacharacterthatfollowstheescapesequenceisalsoavalidhexadecimaldigit,itmusteitherincludesixdigitsintheescapesequenceoruseawhitespacecharactertoterminatetheescapesequence.Forexample,\000020denotesaspace.

Page 41: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

EncoderClassMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 42: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Encoder.HtmlAttributeEncodeMethodEncoderClassSeeAlso

EncodesaninputstringforuseinanHTMLattribute.

Namespace:Microsoft.Security.ApplicationAssembly:AntiXssLibrary40(inAntiXssLibrary40.dll)Version:4.2.0.0

Page 43: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

publicstaticstringHtmlAttributeEncode(

stringinput

)

VisualBasic

PublicSharedFunctionHtmlAttributeEncode(_

inputAsString_

)AsString

VisualC++

public:

staticString^HtmlAttributeEncode(

String^input

)

ParametersinputType:System.StringStringtobeencoded.

ReturnValueTheinputstringencodedforuseinanHTMLattribute.

http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
Page 44: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

RemarksThisfunctionencodesallbutknownsafecharacters.Charactersareencodedusing&#DECIMAL;notation.Safecharactersinclude:a-z LowercasealphabetA-Z Uppercasealphabet0-9 Numbers, Comma. Period- Dash_ Underscore

ThesafelistmaybeadjustedusingMarkAsSafe(LowerCodeCharts,LowerMidCodeCharts,MidCodeCharts,UpperMidCodeCharts,UpperCodeCharts).Exampleinputsandencodedoutputs:alert('XSSAttack!'); alert(&#39;XSS&#32;Attack!&#39;);[email protected] [email protected]

Anti-Cross&#32;Site&#32;Scripting&#32;Library

Page 45: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

EncoderClassMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 46: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Encoder.HtmlEncodeMethodEncoderClassSeeAlso

Page 47: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

OverloadList

Name DescriptionHtmlEncode(String) EncodesinputstringsforuseinHTML.HtmlEncode(String,Boolean)

EncodesinputstringsforuseinHTML.

Page 48: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

EncoderClassEncoderMembersMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 49: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Encoder.HtmlEncodeMethod(String)EncoderClassSeeAlso

EncodesinputstringsforuseinHTML.

Namespace:Microsoft.Security.ApplicationAssembly:AntiXssLibrary40(inAntiXssLibrary40.dll)Version:4.2.0.0

Page 50: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

publicstaticstringHtmlEncode(

stringinput

)

VisualBasic

PublicSharedFunctionHtmlEncode(_

inputAsString_

)AsString

VisualC++

public:

staticString^HtmlEncode(

String^input

)

ParametersinputType:System.StringStringtobeencoded.

ReturnValueEncodedstringforuseinHTML.

http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
Page 51: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

RemarksAllcharactersnotsafelistedareencodedtotheirUnicodedecimalvalue,using&#DECIMAL;notation.Thedefaultsafecharactersinclude:a-z LowercasealphabetA-Z Uppercasealphabet0-9 Numbers, Comma. Period- Dash_ Underscore' Apostrophe

Space

ThesafelistmaybeadjustedusingMarkAsSafe(LowerCodeCharts,LowerMidCodeCharts,MidCodeCharts,UpperMidCodeCharts,UpperCodeCharts).Exampleinputsandtheirrelatedencodedoutputs:<script>alert('XSSAttack!');</script>

&lt;script&gt;alert('XSSAttack!');&lt;/script&gt;

[email protected] [email protected]

Anti-CrossSiteScriptingLibrary

"Anti-CrossSiteScriptingLibrary"

&quote;Anti-CrossSiteScriptingLibrary&quote;

Page 52: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

EncoderClassHtmlEncodeOverloadMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 53: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Encoder.HtmlEncodeMethod(String,Boolean)EncoderClassSeeAlso

EncodesinputstringsforuseinHTML.

Namespace:Microsoft.Security.ApplicationAssembly:AntiXssLibrary40(inAntiXssLibrary40.dll)Version:4.2.0.0

Page 54: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

publicstaticstringHtmlEncode(

stringinput,

booluseNamedEntities

)

VisualBasic

PublicSharedFunctionHtmlEncode(_

inputAsString,_

useNamedEntitiesAsBoolean_

)AsString

VisualC++

public:

staticString^HtmlEncode(

String^input,

booluseNamedEntities

)

ParametersinputType:System.StringStringtobeencoded.useNamedEntitiesType:System.BooleanValueindicatingiftheHTML4.0namedentitiesshouldbeused.

ReturnValue

http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/a28wyd50
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/a28wyd50
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/a28wyd50
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/a28wyd50
Page 55: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

EncodedstringforuseinHTML.

Page 56: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

RemarksAllcharactersnotsafelistedareencodedtotheirUnicodedecimalvalue,using&#DECIMAL;notation.IfyouchoosetousenamedentitiesthenifacharacterisanHTML4.0namedentitythenamedentitywillbeused.Thedefaultsafecharactersinclude:a-z LowercasealphabetA-Z Uppercasealphabet0-9 Numbers, Comma. Period- Dash_ Underscore' Apostrophe

Space

ThesafelistmaybeadjustedusingMarkAsSafe(LowerCodeCharts,LowerMidCodeCharts,MidCodeCharts,UpperMidCodeCharts,UpperCodeCharts).Exampleinputsandtheirrelatedencodedoutputs:<script>alert('XSSAttack!');</script>

&lt;script&gt;alert('XSSAttack!');&lt;/script&gt;

[email protected] [email protected]

Anti-CrossSiteScriptingLibrary

"Anti-CrossSiteScriptingLibrary"

&quote;Anti-CrossSiteScriptingLibrary&quote;

Page 57: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

EncoderClassHtmlEncodeOverloadMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 58: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Encoder.HtmlFormUrlEncodeMethodEncoderClassSeeAlso

Page 59: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

OverloadList

Name DescriptionHtmlFormUrlEncode(String) Encodesinputstringsforusein

application/x-www-form-urlencodedformsubmissions.

HtmlFormUrlEncode(String,Int32)

Encodesinputstringsforuseinapplication/x-www-form-urlencodedformsubmissions.

HtmlFormUrlEncode(String,Encoding)

Encodesinputstringsforuseinapplication/x-www-form-urlencodedformsubmissions.

Page 60: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

EncoderClassEncoderMembersMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 61: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Encoder.HtmlFormUrlEncodeMethod(String)EncoderClassSeeAlso

Encodesinputstringsforuseinapplication/x-www-form-urlencodedformsubmissions.

Namespace:Microsoft.Security.ApplicationAssembly:AntiXssLibrary40(inAntiXssLibrary40.dll)Version:4.2.0.0

Page 62: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

publicstaticstringHtmlFormUrlEncode(

stringinput

)

VisualBasic

PublicSharedFunctionHtmlFormUrlEncode(_

inputAsString_

)AsString

VisualC++

public:

staticString^HtmlFormUrlEncode(

String^input

)

ParametersinputType:System.StringStringtobeencoded.

ReturnValueEncodedstringforuseinURLs.

http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
Page 63: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

RemarksThisfunctionencodesallbutknownsafecharacters.Charactersareencodedusing%SINGLE_BYTE_HEXand%DOUBLE_BYTE_HEXnotation.Safecharactersinclude:a-z LowercasealphabetA-Z Uppercasealphabet0-9 Numbers. Period- Dash_ Underscore~ Tilde

Exampleinputsandencodedoutputs:alert('XSSAttack!'); alert%28%27XSS+Attack%21%27%29%[email protected] user%40contoso.comAnti-CrossSiteScriptingLibrary

Anti-Cross+Site+Scripting+Library

Page 64: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

EncoderClassHtmlFormUrlEncodeOverloadMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 65: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Encoder.HtmlFormUrlEncodeMethod(String,Int32)EncoderClassSeeAlso

Encodesinputstringsforuseinapplication/x-www-form-urlencodedformsubmissions.

Namespace:Microsoft.Security.ApplicationAssembly:AntiXssLibrary40(inAntiXssLibrary40.dll)Version:4.2.0.0

Page 66: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

publicstaticstringHtmlFormUrlEncode(

stringinput,

intcodePage

)

VisualBasic

PublicSharedFunctionHtmlFormUrlEncode(_

inputAsString,_

codePageAsInteger_

)AsString

VisualC++

public:

staticString^HtmlFormUrlEncode(

String^input,

intcodePage

)

ParametersinputType:System.StringStringtobeencoded.codePageType:System.Int32Codepagenumberoftheinput.

ReturnValue

http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/td2s409d
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/td2s409d
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/td2s409d
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/td2s409d
Page 67: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

EncodedstringforuseinURLs.

Page 68: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

RemarksThisfunctionencodestheoutputaspertheencodingparameter(codepage)passedtoit.Itencodesallbutknownsafecharacters.Charactersareencodedusing%SINGLE_BYTE_HEXand%DOUBLE_BYTE_HEXnotation.Safecharactersinclude:a-z LowercasealphabetA-Z Uppercasealphabet0-9 Numbers. Period- Dash_ Underscore~ Tilde

Exampleinputsandencodedoutputs:alert('XSSAttack!'); alert%28%27XSS%82%a0Attack%21%27%29%[email protected] user%40contoso.comAnti-CrossSiteScriptingLibrary

Anti-Cross+Site+Scripting+Library

Page 69: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

EncoderClassHtmlFormUrlEncodeOverloadMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 70: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Encoder.HtmlFormUrlEncodeMethod(String,Encoding)EncoderClassSeeAlso

Encodesinputstringsforuseinapplication/x-www-form-urlencodedformsubmissions.

Namespace:Microsoft.Security.ApplicationAssembly:AntiXssLibrary40(inAntiXssLibrary40.dll)Version:4.2.0.0

Page 71: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

publicstaticstringHtmlFormUrlEncode(

stringinput,

EncodinginputEncoding

)

VisualBasic

PublicSharedFunctionHtmlFormUrlEncode(_

inputAsString,_

inputEncodingAsEncoding_

)AsString

VisualC++

public:

staticString^HtmlFormUrlEncode(

String^input,

Encoding^inputEncoding

)

ParametersinputType:System.StringStringtobeencoded.inputEncodingType:System.Text.EncodingInputencodingtype.

ReturnValue

http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/86hf4sb8
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/86hf4sb8
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/86hf4sb8
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/86hf4sb8
Page 72: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

EncodedstringforuseinURLs.

Page 73: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

RemarksThisfunctionencodestheoutputaspertheencodingparameter(codepage)passedtoit.Itencodesallbutknownsafecharacters.Charactersareencodedusing%SINGLE_BYTE_HEXand%DOUBLE_BYTE_HEXnotation.IftheinputEncodingisnullthenUTF-8isassumedbydefault.Safecharactersinclude:a-z LowercasealphabetA-Z Uppercasealphabet0-9 Numbers. Period- Dash_ Underscore~ Tilde

Exampleinputsandencodedoutputs:alert('XSSAttack!'); alert%28%27XSS%82%a0Attack%21%27%29%[email protected] user%40contoso.comAnti-CrossSiteScriptingLibrary

Anti-Cross+Site+Scripting+Library

Page 74: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

EncoderClassHtmlFormUrlEncodeOverloadMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 75: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Encoder.JavaScriptEncodeMethodEncoderClassSeeAlso

Page 76: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

OverloadList

Name DescriptionJavaScriptEncode(String) Encodesinputstringsforusein

JavaScript.JavaScriptEncode(String,Boolean)

EncodesinputstringsforuseinJavaScript.

Page 77: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

EncoderClassEncoderMembersMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 78: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Encoder.JavaScriptEncodeMethod(String)EncoderClassSeeAlso

EncodesinputstringsforuseinJavaScript.

Namespace:Microsoft.Security.ApplicationAssembly:AntiXssLibrary40(inAntiXssLibrary40.dll)Version:4.2.0.0

Page 79: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

publicstaticstringJavaScriptEncode(

stringinput

)

VisualBasic

PublicSharedFunctionJavaScriptEncode(_

inputAsString_

)AsString

VisualC++

public:

staticString^JavaScriptEncode(

String^input

)

ParametersinputType:System.StringStringtobeencoded.

ReturnValueEncodedstringforuseinJavaScript.

http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
Page 80: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

RemarksThisfunctionencodesallbutknownsafecharacters.Charactersareencodedusing\xSINGLE_BYTE_HEXand\uDOUBLE_BYTE_HEXnotation.Safecharactersinclude:a-z LowercasealphabetA-Z Uppercasealphabet0-9 Numbers, Comma. Period- Dash_ Underscore

SpaceOtherInternationalcharacterranges

Exampleinputsandencodedoutputs:alert('XSSAttack!'); 'alert\x28\x27XSS

Attack\x21\x27\x29\x3b'[email protected] 'user\x40contoso.com'Anti-CrossSiteScriptingLibrary

'Anti-CrossSiteScriptingLibrary'

Page 81: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

EncoderClassJavaScriptEncodeOverloadMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 82: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Encoder.JavaScriptEncodeMethod(String,Boolean)EncoderClassSeeAlso

EncodesinputstringsforuseinJavaScript.

Namespace:Microsoft.Security.ApplicationAssembly:AntiXssLibrary40(inAntiXssLibrary40.dll)Version:4.2.0.0

Page 83: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

publicstaticstringJavaScriptEncode(

stringinput,

boolemitQuotes

)

VisualBasic

PublicSharedFunctionJavaScriptEncode(_

inputAsString,_

emitQuotesAsBoolean_

)AsString

VisualC++

public:

staticString^JavaScriptEncode(

String^input,

boolemitQuotes

)

ParametersinputType:System.StringStringtobeencoded.emitQuotesType:System.Booleanvalueindicatingwhetherornottoemitquotes.true=emitquote.false=noquote.

http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/a28wyd50
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/a28wyd50
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/a28wyd50
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/a28wyd50
Page 84: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

ReturnValueEncodedstringforuseinJavaScriptanddoesnotreturntheoutputwithenquotes.

Page 85: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

RemarksThisfunctionencodesallbutknownsafecharacters.Charactersareencodedusing\xSINGLE_BYTE_HEXand\uDOUBLE_BYTE_HEXnotation.Safecharactersinclude:a-z LowercasealphabetA-Z Uppercasealphabet0-9 Numbers, Comma. Period- Dash_ Underscore

SpaceOtherInternationalcharacterranges

Exampleinputsandencodedoutputs:alert('XSSAttack!'); 'alert\x28\x27XSS

Attack\x21\x27\x29\x3b'[email protected] 'user\x40contoso.com'Anti-CrossSiteScriptingLibrary

'Anti-CrossSiteScriptingLibrary'

Page 86: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

EncoderClassJavaScriptEncodeOverloadMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 87: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Encoder.LdapDistinguishedNameEncodeMethodEncoderClassSeeAlso

Page 88: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

OverloadList

Name DescriptionLdapDistinguishedNameEncode(String) Encodesinputstringsfor

useasavalueinLightweightDirectoryAccessProtocol(LDAP)DNs.

LdapDistinguishedNameEncode(String,Boolean,Boolean)

EncodesinputstringsforuseasavalueinLightweightDirectoryAccessProtocol(LDAP)DNs.

Page 89: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

EncoderClassEncoderMembersMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 90: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Encoder.LdapDistinguishedNameEncodeMethod(String)EncoderClassSeeAlso

EncodesinputstringsforuseasavalueinLightweightDirectoryAccessProtocol(LDAP)DNs.

Namespace:Microsoft.Security.ApplicationAssembly:AntiXssLibrary40(inAntiXssLibrary40.dll)Version:4.2.0.0

Page 91: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

publicstaticstringLdapDistinguishedNameEncode(

stringinput

)

VisualBasic

PublicSharedFunctionLdapDistinguishedNameEncode(_

inputAsString_

)AsString

VisualC++

public:

staticString^LdapDistinguishedNameEncode(

String^input

)

ParametersinputType:System.StringStringtobeencoded.

ReturnValueEncodedstringforuseasavalueinLDAPDNs.

http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
Page 92: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

RemarksThismethodencodesallbutknownsafecharactersdefinedinthesafelist.RFC2253definestheformatinwhichspecialcharactersneedtobeescapedtobeusedinsideasearchfilter.Specialcharactersneedtobeencodedin#XXformatwhereXXisthehexrepresentationofthecharacteroraspecific\escapeformat.Thefollowingexamplesillustratetheuseoftheescapingmechanism.,+\"\<> \,\+\"\\\<\>hello \hellohello hello\#hello \#helloLučić Lu#C4#8Di#C4#87

Page 93: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

EncoderClassLdapDistinguishedNameEncodeOverloadMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 94: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Encoder.LdapDistinguishedNameEncodeMethod(String,Boolean,Boolean)EncoderClassSeeAlso

EncodesinputstringsforuseasavalueinLightweightDirectoryAccessProtocol(LDAP)DNs.

Namespace:Microsoft.Security.ApplicationAssembly:AntiXssLibrary40(inAntiXssLibrary40.dll)Version:4.2.0.0

Page 95: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

publicstaticstringLdapDistinguishedNameEncode(

stringinput,

booluseInitialCharacterRules,

booluseFinalCharacterRule

)

VisualBasic

PublicSharedFunctionLdapDistinguishedNameEncode(_

inputAsString,_

useInitialCharacterRulesAsBoolean,_

useFinalCharacterRuleAsBoolean_

)AsString

VisualC++

public:

staticString^LdapDistinguishedNameEncode(

String^input,

booluseInitialCharacterRules,

booluseFinalCharacterRule

)

ParametersinputType:System.StringStringtobeencoded.useInitialCharacterRulesType:System.BooleanValueindicatingwhetherthespecialcaserulesforencodingofspacesand

http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/a28wyd50
http://msdn2.microsoft.com/en-us/library/a28wyd50
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/a28wyd50
http://msdn2.microsoft.com/en-us/library/a28wyd50
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/a28wyd50
http://msdn2.microsoft.com/en-us/library/a28wyd50
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/a28wyd50
Page 96: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

octothorpesatthestartofastringareused.useFinalCharacterRuleType:System.BooleanValueindicatingwhetherthespecialcaseforencodingoffinalcharacterspacesisused.

ReturnValueEncodedstringforuseasavalueinLDAPDNs.

http://msdn2.microsoft.com/en-us/library/a28wyd50
Page 97: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

RemarksThismethodencodesallbutknownsafecharactersdefinedinthesafelist.RFC2253definestheformatinwhichspecialcharactersneedtobeescapedtobeusedinsideasearchfilter.Specialcharactersneedtobeencodedin#XXformatwhereXXisthehexrepresentationofthecharacteroraspecific\escapeformat.Thefollowingexamplesillustratetheuseoftheescapingmechanism.,+\"\<> \,\+\"\\\<\>hello \hellohello hello\#hello \#helloLučić Lu#C4#8Di#C4#87

IfuseInitialCharacterRulesissettofalsethenescapingoftheinitialspaceoroctothorpecharactersisnotperformed;,+\"\<> \,\+\"\\\<\>hello hellohello hello\#hello #helloLučić Lu#C4#8Di#C4#87

IfuseFinalCharacterRuleissettofalsethenescapingofaspaceattheendofastringisnotperformed;,+\"\<> \,\+\"\\\<\>hello hellohello hello#hello #helloLučić Lu#C4#8Di#C4#87

Page 98: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

EncoderClassLdapDistinguishedNameEncodeOverloadMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 99: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Encoder.LdapEncodeMethodEncoderClassSeeAlso

EncodesinputstringstobeusedasavalueinLightweightDirectoryAccessProtocol(LDAP)searchqueries.

Namespace:Microsoft.Security.ApplicationAssembly:AntiXssLibrary40(inAntiXssLibrary40.dll)Version:4.2.0.0

Page 100: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

[ObsoleteAttribute("Thismethodhasbeendeprecated.PleaseuseEncoder.LdapFilterEncode()instead.")]

publicstaticstringLdapEncode(

stringinput

)

VisualBasic

<ObsoleteAttribute("Thismethodhasbeendeprecated.PleaseuseEncoder.LdapFilterEncode()instead.")>_

PublicSharedFunctionLdapEncode(_

inputAsString_

)AsString

VisualC++

[ObsoleteAttribute(L"Thismethodhasbeendeprecated.PleaseuseEncoder.LdapFilterEncode()instead.")]

public:

staticString^LdapEncode(

String^input

)

ParametersinputType:System.StringStringtobeencoded.

ReturnValueEncodedstringforuseinLDAPsearchqueries.

http://msdn2.microsoft.com/en-us/library/fwz0y5c2
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/fwz0y5c2
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/fwz0y5c2
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
Page 101: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

RemarksThismethodencodesallbutknownsafecharactersdefinedinthesafelist.RFC4515definestheformatinwhichspecialcharactersneedtobeescapedtobeusedinsideasearchfilter.Specialcharactersneedtobeencodedin\XXformatwhereXXisthehexrepresentationofthecharacter.Thefollowingexamplesillustratetheuseoftheescapingmechanism.ParensRUs(forallyourparentheticalneeds)

ParensRUs\28forallyourparentheticalneeds\29

* \2AC:\MyFile C:\5CMyFileNULLNULLNULLEOT(binary) \00\00\00\04Lučić Lu\C4\8Di\C4\87

Page 102: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

EncoderClassMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 103: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Encoder.LdapFilterEncodeMethodEncoderClassSeeAlso

EncodesinputstringsforuseasavalueinLightweightDirectoryAccessProtocol(LDAP)filterqueries.

Namespace:Microsoft.Security.ApplicationAssembly:AntiXssLibrary40(inAntiXssLibrary40.dll)Version:4.2.0.0

Page 104: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

publicstaticstringLdapFilterEncode(

stringinput

)

VisualBasic

PublicSharedFunctionLdapFilterEncode(_

inputAsString_

)AsString

VisualC++

public:

staticString^LdapFilterEncode(

String^input

)

ParametersinputType:System.StringStringtobeencoded.

ReturnValueEncodedstringforuseasavalueinLDAPfilterqueries.

http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
Page 105: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

RemarksThismethodencodesallbutknownsafecharactersdefinedinthesafelist.RFC4515definestheformatinwhichspecialcharactersneedtobeescapedtobeusedinsideasearchfilter.Specialcharactersneedtobeencodedin\XXformatwhereXXisthehexrepresentationofthecharacter.Thefollowingexamplesillustratetheuseoftheescapingmechanism.ParensRUs(forallyourparentheticalneeds)

ParensRUs\28forallyourparentheticalneeds\29

* \2AC:\MyFile C:\5CMyFileNULLNULLNULLEOT(binary) \00\00\00\04Lučić Lu\C4\8Di\C4\87

Page 106: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

EncoderClassMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 107: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Encoder.UrlEncodeMethodEncoderClassSeeAlso

Page 108: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

OverloadList

Name DescriptionUrlEncode(String) Encodesinputstringsforuseinuniversal

resourcelocators(URLs).UrlEncode(String,Int32)

Encodesinputstringsforuseinuniversalresourcelocators(URLs).

UrlEncode(String,Encoding)

Encodesinputstringsforuseinuniversalresourcelocators(URLs).

Page 109: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

EncoderClassEncoderMembersMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 110: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Encoder.UrlEncodeMethod(String)EncoderClassSeeAlso

Encodesinputstringsforuseinuniversalresourcelocators(URLs).

Namespace:Microsoft.Security.ApplicationAssembly:AntiXssLibrary40(inAntiXssLibrary40.dll)Version:4.2.0.0

Page 111: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

publicstaticstringUrlEncode(

stringinput

)

VisualBasic

PublicSharedFunctionUrlEncode(_

inputAsString_

)AsString

VisualC++

public:

staticString^UrlEncode(

String^input

)

ParametersinputType:System.StringStringtobeencoded.

ReturnValueEncodedstringforuseinURLs.

http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
Page 112: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

RemarksThisfunctionencodesallbutknownsafecharacters.Charactersareencodedusing%SINGLE_BYTE_HEXand%DOUBLE_BYTE_HEXnotation.Safecharactersinclude:a-z LowercasealphabetA-Z Uppercasealphabet0-9 Numbers. Period- Dash_ Underscore~ Tilde

Exampleinputsandencodedoutputs:alert('XSSAttack!'); alert%28%27XSS%20Attack%21%27%29%[email protected] user%40contoso.comAnti-CrossSiteScriptingLibrary

Anti-Cross%20Site%20Scripting%20Library

Page 113: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

EncoderClassUrlEncodeOverloadMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 114: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Encoder.UrlEncodeMethod(String,Int32)EncoderClassSeeAlso

Encodesinputstringsforuseinuniversalresourcelocators(URLs).

Namespace:Microsoft.Security.ApplicationAssembly:AntiXssLibrary40(inAntiXssLibrary40.dll)Version:4.2.0.0

Page 115: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

publicstaticstringUrlEncode(

stringinput,

intcodePage

)

VisualBasic

PublicSharedFunctionUrlEncode(_

inputAsString,_

codePageAsInteger_

)AsString

VisualC++

public:

staticString^UrlEncode(

String^input,

intcodePage

)

ParametersinputType:System.StringStringtobeencoded.codePageType:System.Int32Codepagenumberoftheinput.

ReturnValue

http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/td2s409d
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/td2s409d
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/td2s409d
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/td2s409d
Page 116: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

EncodedstringforuseinURLs.

Page 117: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

RemarksThisfunctionencodestheoutputaspertheencodingparameter(codepage)passedtoit.Itencodesallbutknownsafecharacters.Charactersareencodedusing%SINGLE_BYTE_HEXand%DOUBLE_BYTE_HEXnotation.Safecharactersinclude:a-z LowercasealphabetA-Z Uppercasealphabet0-9 Numbers. Period- Dash_ Underscore~ Tilde

Exampleinputsandencodedoutputs:alert('XSSAttack!'); alert%28%27XSS%82%a0Attack%21%27%29%[email protected] user%40contoso.comAnti-CrossSiteScriptingLibrary

Anti-Cross%20Site%20Scripting%20Library

Page 118: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

EncoderClassUrlEncodeOverloadMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 119: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Encoder.UrlEncodeMethod(String,Encoding)EncoderClassSeeAlso

Encodesinputstringsforuseinuniversalresourcelocators(URLs).

Namespace:Microsoft.Security.ApplicationAssembly:AntiXssLibrary40(inAntiXssLibrary40.dll)Version:4.2.0.0

Page 120: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

publicstaticstringUrlEncode(

stringinput,

EncodinginputEncoding

)

VisualBasic

PublicSharedFunctionUrlEncode(_

inputAsString,_

inputEncodingAsEncoding_

)AsString

VisualC++

public:

staticString^UrlEncode(

String^input,

Encoding^inputEncoding

)

ParametersinputType:System.StringStringtobeencoded.inputEncodingType:System.Text.EncodingInputencodingtype.

ReturnValue

http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/86hf4sb8
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/86hf4sb8
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/86hf4sb8
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/86hf4sb8
Page 121: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

EncodedstringforuseinURLs.

Page 122: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

RemarksThisfunctionencodestheoutputaspertheencodingparameter(codepage)passedtoit.Itencodesallbutknownsafecharacters.Charactersareencodedusing%SINGLE_BYTE_HEXand%DOUBLE_BYTE_HEXnotation.IftheinputEncodingisnullthenUTF-8isassumedbydefault.Safecharactersinclude:a-z LowercasealphabetA-Z Uppercasealphabet0-9 Numbers. Period- Dash_ Underscore~ Tilde

Exampleinputsandencodedoutputs:alert('XSSAttack!'); alert%28%27XSS%82%a0Attack%21%27%29%[email protected] user%40contoso.comAnti-CrossSiteScriptingLibrary

Anti-Cross%20Site%20Scripting%20Library

Page 123: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

EncoderClassUrlEncodeOverloadMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 124: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Encoder.UrlPathEncodeMethodEncoderClassSeeAlso

URL-encodesthepathsectionofaURLstringandreturnstheencodedstring.

Namespace:Microsoft.Security.ApplicationAssembly:AntiXssLibrary40(inAntiXssLibrary40.dll)Version:4.2.0.0

Page 125: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

publicstaticstringUrlPathEncode(

stringinput

)

VisualBasic

PublicSharedFunctionUrlPathEncode(_

inputAsString_

)AsString

VisualC++

public:

staticString^UrlPathEncode(

String^input

)

ParametersinputType:System.StringThetexttoURLpathencode

ReturnValueTheURLpathencodedtext.

http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
Page 126: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

EncoderClassMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 127: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Encoder.VisualBasicScriptEncodeMethodEncoderClassSeeAlso

EncodesinputstringsforuseinVisualBasicScript.

Namespace:Microsoft.Security.ApplicationAssembly:AntiXssLibrary40(inAntiXssLibrary40.dll)Version:4.2.0.0

Page 128: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

publicstaticstringVisualBasicScriptEncode(

stringinput

)

VisualBasic

PublicSharedFunctionVisualBasicScriptEncode(_

inputAsString_

)AsString

VisualC++

public:

staticString^VisualBasicScriptEncode(

String^input

)

ParametersinputType:System.StringStringtobeencoded.

ReturnValueEncodedstringforuseinVisualBasicScript.

http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
Page 129: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

RemarksThisfunctionencodesallbutknownsafecharacters.Charactersareencodedusing&chrw(DECIMAL)notation.Safecharactersinclude:a-z LowercasealphabetA-Z Uppercasealphabet0-9 Numbers, Comma. Period- Dash_ Underscore

Space

Exampleinputsandencodedoutputs:alert('XSSAttack!');

"alert"&chrw(40)&chrw(39)&"XSSAttack"&chrw(33)&chrw(39)&chrw(41)&chrw(59)

[email protected] "user"&chrw(64)&"contoso.com"Anti-CrossSiteScriptingLibrary

"Anti-CrossSiteScriptingLibrary"

Page 130: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

EncoderClassMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 131: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Encoder.XmlAttributeEncodeMethodEncoderClassSeeAlso

EncodesinputstringsforuseinXMLattributes.

Namespace:Microsoft.Security.ApplicationAssembly:AntiXssLibrary40(inAntiXssLibrary40.dll)Version:4.2.0.0

Page 132: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

publicstaticstringXmlAttributeEncode(

stringinput

)

VisualBasic

PublicSharedFunctionXmlAttributeEncode(_

inputAsString_

)AsString

VisualC++

public:

staticString^XmlAttributeEncode(

String^input

)

ParametersinputType:System.StringStringtobeencoded.

ReturnValueEncodedstringforuseinXMLattributes.

http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
Page 133: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

RemarksThisfunctionencodesallbutknownsafecharacters.Charactersareencodedusing&#DECIMAL;notation.Safecharactersinclude:a-z LowercasealphabetA-Z Uppercasealphabet0-9 Numbers, Comma. Period- Dash_ Underscore

ThesafelistmaybeadjustedusingMarkAsSafe(LowerCodeCharts,LowerMidCodeCharts,MidCodeCharts,UpperMidCodeCharts,UpperCodeCharts).Exampleinputsandencodedoutputs:alert('XSSAttack!'); alert(&apos;XSSAttack!&apos);[email protected] [email protected]

Anti-Cross&#32;Site&#32;Scripting&#32;Library

Page 134: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

EncoderClassMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 135: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Encoder.XmlEncodeMethodEncoderClassSeeAlso

EncodesinputstringsforuseinXML.

Namespace:Microsoft.Security.ApplicationAssembly:AntiXssLibrary40(inAntiXssLibrary40.dll)Version:4.2.0.0

Page 136: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

publicstaticstringXmlEncode(

stringinput

)

VisualBasic

PublicSharedFunctionXmlEncode(_

inputAsString_

)AsString

VisualC++

public:

staticString^XmlEncode(

String^input

)

ParametersinputType:System.StringStringtobeencoded.

ReturnValueEncodedstringforuseinXML.

http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
Page 137: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

RemarksThisfunctionencodesallbutknownsafecharacters.Charactersareencodedusing&#DECIMAL;notation.Safecharactersinclude:a-z LowercasealphabetA-Z Uppercasealphabet0-9 Numbers, Comma. Period- Dash_ Underscore

Space

ThesafelistmaybeadjustedusingMarkAsSafe(LowerCodeCharts,LowerMidCodeCharts,MidCodeCharts,UpperMidCodeCharts,UpperCodeCharts).Exampleinputsandencodedoutputs:alert('XSSAttack!'); alert(&apos;XSSAttack!&apos;);[email protected] [email protected] Anti-CrossSiteScriptingLibrary

Page 138: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

EncoderClassMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 139: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

LowerCodeChartsEnumerationSeeAlso

ValuesforthelowestsectionoftheUTF8Unicodecodetables,fromU0000toU0FFF.

Namespace:Microsoft.Security.ApplicationAssembly:AntiXssLibrary40(inAntiXssLibrary40.dll)Version:4.2.0.0

Page 140: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

[FlagsAttribute]

publicenumLowerCodeCharts

VisualBasic

<FlagsAttribute>_

PublicEnumerationLowerCodeCharts

VisualC++

[FlagsAttribute]

publicenumclassLowerCodeCharts

http://msdn2.microsoft.com/en-us/library/dk06fkbc
http://msdn2.microsoft.com/en-us/library/dk06fkbc
http://msdn2.microsoft.com/en-us/library/dk06fkbc
Page 141: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Members

Membername Value DescriptionNone 0 Nocodecharts

fromthelowerregionoftheUnicodetablesaresafe-listed.

BasicLatin 1 TheBasicLatincodetable.

C1ControlsAndLatin1Supplement 2 TheC1ControlsandLatin-1Supplementcodetable.

LatinExtendedA 4 TheLatinExtended-Acodetable.

LatinExtendedB 8 TheLatinExtended-Bcodetable.

IpaExtensions 16 TheIPAExtensionscodetable.

SpacingModifierLetters 32 TheSpacingModifierLetterscodetable.

CombiningDiacriticalMarks 64 TheCombiningDiacriticalMarkscodetable.

GreekAndCoptic 128 TheGreekandCopticcodetable.

Cyrillic 256 TheCyrillic

Page 142: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

codetable.CyrillicSupplement 512 TheCyrillic

Supplementcodetable.

Armenian 1024 TheArmeniancodetable.

Hebrew 2048 TheHebrewcodetable.

Arabic 4096 TheArabiccodetable.

Syriac 8192 TheSyriaccodetable.

ArabicSupplement 16384 TheArabicSupplementcodetable.

Thaana 32768 TheThaanacodetable.

Nko 65536 TheNkocodetable.

Samaritan 131072 TheSamaritancodetable.

Devanagari 262144 TheDevanagaricodetable.

Bengali 524288 TheBengalicodetable.

Gurmukhi 1048576 TheGurmukhicodetable.

Gujarati 2097152 TheGujaraticodetable.

Oriya 4194304 TheOriyacodetable.

Tamil 8388608 TheTamilcodetable.

Telugu 16777216 TheTelugu

Page 143: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

codetable.Kannada 33554432 TheKannada

codetable.Malayalam 67108864 TheMalayalam

codetable.Sinhala 134217728 TheSinhala

codetable.Thai 268435456 TheThaicode

table.Lao 536870912 TheLaocode

table.Tibetan 1073741824 TheTibetan

codetable.Default 127 Thedefault

codetablesmarkedassafeoninitialisation.

Page 144: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

Microsoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 145: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

LowerMidCodeChartsEnumerationSeeAlso

Valuesforthelower-midsectionoftheUTF8Unicodecodetables,fromU1000toU1EFF.

Namespace:Microsoft.Security.ApplicationAssembly:AntiXssLibrary40(inAntiXssLibrary40.dll)Version:4.2.0.0

Page 146: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

[FlagsAttribute]

publicenumLowerMidCodeCharts

VisualBasic

<FlagsAttribute>_

PublicEnumerationLowerMidCodeCharts

VisualC++

[FlagsAttribute]

publicenumclassLowerMidCodeCharts

http://msdn2.microsoft.com/en-us/library/dk06fkbc
http://msdn2.microsoft.com/en-us/library/dk06fkbc
http://msdn2.microsoft.com/en-us/library/dk06fkbc
Page 147: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Members

Membername Value DescriptionNone 0 Nocode

chartsfromthelower-midregionoftheUnicodetablesaresafe-listed.

Myanmar 1 TheMyanmarcodetable.

Georgian 2 TheGeorgiancodetable.

HangulJamo 4 TheHangulJamocodetable.

Ethiopic 8 TheEthiopiccodetable.

EthiopicSupplement 16 TheEthiopicsupplementcodetable.

Cherokee 32 TheCherokeecodetable.

UnifiedCanadianAboriginalSyllabics 64 TheUnifiedCanadianAboriginalSyllabicscodetable.

Ogham 128 TheOgham

Page 148: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

codetable.Runic 256 TheRunic

codetable.Tagalog 512 The

Tagalogcodetable.

Hanunoo 1024 TheHanunoocodetable.

Buhid 2048 TheBuhidcodetable.

Tagbanwa 4096 TheTagbanwacodetable.

Khmer 8192 TheKhmercodetable.

Mongolian 16384 TheMongoliancodetable.

UnifiedCanadianAboriginalSyllabicsExtended 32768 TheUnifiedCanadianAboriginalSyllabicsExtendedcodetable.

Limbu 65536 TheLimbucodetable.

TaiLe 131072 TheTaiLecodetable.

NewTaiLue 262144 TheNewTaiLuecodetable.

KhmerSymbols 524288 TheKhmerSymbolscodetable

Buginese 1048576 The

Page 149: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Buginesecodetable.

TaiTham 2097152 TheTaiThamcodetable.

Balinese 4194304 TheBalinesecodetable.

Sudanese 8388608 TheSudanesecodetable.

Lepcha 16777216 TheLepchacodetable.

OlChiki 33554432 TheOlChikicodetable.

VedicExtensions 67108864 TheVedicExtensionscodetable.

PhoneticExtensions 134217728 ThePhoneticExtensionscodetable.

PhoneticExtensionsSupplement 268435456 ThePhoneticExtensionsSupplementcodetable.

CombiningDiacriticalMarksSupplement 536870912 TheCombiningDiacriticalMarksSupplementcodetable.

LatinExtendedAdditional 1073741824 TheLatinExtended

Page 150: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Additionalcodetable.

Page 151: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

Microsoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 152: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

MidCodeChartsEnumerationSeeAlso

ValuesforthemiddlesectionoftheUTF8Unicodecodetables,fromU1F00toU2DDF

Namespace:Microsoft.Security.ApplicationAssembly:AntiXssLibrary40(inAntiXssLibrary40.dll)Version:4.2.0.0

Page 153: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

[FlagsAttribute]

publicenumMidCodeCharts

VisualBasic

<FlagsAttribute>_

PublicEnumerationMidCodeCharts

VisualC++

[FlagsAttribute]

publicenumclassMidCodeCharts

http://msdn2.microsoft.com/en-us/library/dk06fkbc
http://msdn2.microsoft.com/en-us/library/dk06fkbc
http://msdn2.microsoft.com/en-us/library/dk06fkbc
Page 154: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Members

Membername Value DescriptionNone 0 Nocode

chartsfromthelowerregionoftheUnicodetablesaresafe-listed.

GreekExtended 1 TheGreekExtendedcodetable.

GeneralPunctuation 2 TheGeneralPunctuationcodetable.

SuperscriptsAndSubscripts 4 TheSuperscriptsandSubscriptscodetable.

CurrencySymbols 8 TheCurrencySymbolscodetable.

CombiningDiacriticalMarksForSymbols 16 TheCombiningDiacriticalMarksforSymbolscodetable.

LetterlikeSymbols 32 TheLetterlikeSymbolscodetable.

NumberForms 64 TheNumberFormscodetable.

Page 155: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Arrows 128 TheArrowscodetable.

MathematicalOperators 256 TheMathematicalOperatorscodetable.

MiscellaneousTechnical 512 TheMiscellaneousTechnicalcodetable.

ControlPictures 1024 TheControlPicturescodetable.

OpticalCharacterRecognition 2048 TheOpticalCharacterRecognitiontable.

EnclosedAlphanumerics 4096 TheEnclosedAlphanumericcodetable.

BoxDrawing 8192 TheBoxDrawingcodetable.

BlockElements 16384 TheBlockElementscodetable.

GeometricShapes 32768 TheGeometricShapescodetable.

MiscellaneousSymbols 65536 TheMiscellaneousSymbolscodetable.

Dingbats 131072 TheDingbatscodetable.

Page 156: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MiscellaneousMathematicalSymbolsA 262144 TheMiscellaneousMathematicalSymbols-Acodetable.

SupplementalArrowsA 524288 TheSupplementalArrows-Acodetable.

BraillePatterns 1048576 TheBraillePatternscodetable.

SupplementalArrowsB 2097152 TheSupplementalArrows-Bcodetable.

MiscellaneousMathematicalSymbolsB 4194304 TheMiscellaneousMathematicalSymbols-Bcodetable.

SupplementalMathematicalOperators 8388608 TheSupplementalMathematicalOperatorscodetable.

MiscellaneousSymbolsAndArrows 16777216 TheMiscellaneousSymbolsandArrowscodetable.

Glagolitic 33554432 TheGlagoliticcodetable.

LatinExtendedC 67108864 TheLatinExtended-Ccodetable.

Coptic 134217728 TheCoptic

Page 157: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

codetable.GeorgianSupplement 268435456 TheGeorgian

Supplementcodetable.

Tifinagh 536870912 TheTifinaghcodetable.

EthiopicExtended 16384 TheEthiopicExtendedcodetable.

Page 158: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

Microsoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 159: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

SanitizerClassMembersSeeAlso

SanitizesinputHTMLtomakeitsafetobedisplayedonabrowserbyremovingpotentiallydangeroustags.

Namespace:Microsoft.Security.ApplicationAssembly:HtmlSanitizationLibrary(inHtmlSanitizationLibrary.dll)Version:4.2.0.0

Page 160: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

publicstaticclassSanitizer

VisualBasic

PublicNotInheritableClassSanitizer

VisualC++

publicrefclassSanitizerabstractsealed

Page 161: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

RemarksThissantizationlibraryusesthePrincipleofInclusions,sometimesreferredtoas"safe-listing"toprovideprotectionagainstinjectionattacks.Withsafe-listingprotection,algorithmslookforvalidinputsandautomaticallytreateverythingoutsidethatsetasapotentialattack.Thislibrarycanbeusedasadefenseindepthapproachwithothermitigationtechniques.

Page 162: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

InheritanceHierarchySystem.ObjectMicrosoft.Security.Application.Sanitizer

http://msdn2.microsoft.com/en-us/library/e5kfa45b
Page 163: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

SanitizerMembersMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 164: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

SanitizerMembersSanitizerClassMethodsSeeAlso

Page 165: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Methods

Name DescriptionGetSafeHtml(String) SanitizesinputHTML

documentforsafedisplayonbrowser.

GetSafeHtml(TextReader,Stream) SanitizesinputHTMLdocumentforsafedisplayonbrowser.

GetSafeHtml(TextReader,TextWriter)

SanitizesinputHTMLdocumentforsafedisplayonbrowser.

GetSafeHtmlFragment(String) SanitizesinputHTMLfragmentforsafedisplayonbrowser.

GetSafeHtmlFragment(TextReader,Stream)

SanitizesinputHTMLfragmentforsafedisplayonbrowser.

GetSafeHtmlFragment(TextReader,TextWriter)

SanitizesinputHTMLfragmentforsafedisplayonbrowser.

Page 166: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

SanitizerClassMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 167: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

SanitizerMethodsSanitizerClassSeeAlso

Page 168: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Methods

Name DescriptionGetSafeHtml(String) SanitizesinputHTML

documentforsafedisplayonbrowser.

GetSafeHtml(TextReader,Stream) SanitizesinputHTMLdocumentforsafedisplayonbrowser.

GetSafeHtml(TextReader,TextWriter)

SanitizesinputHTMLdocumentforsafedisplayonbrowser.

GetSafeHtmlFragment(String) SanitizesinputHTMLfragmentforsafedisplayonbrowser.

GetSafeHtmlFragment(TextReader,Stream)

SanitizesinputHTMLfragmentforsafedisplayonbrowser.

GetSafeHtmlFragment(TextReader,TextWriter)

SanitizesinputHTMLfragmentforsafedisplayonbrowser.

Page 169: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

SanitizerClassMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 170: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Sanitizer.GetSafeHtmlMethodSanitizerClassSeeAlso

Page 171: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

OverloadList

Name DescriptionGetSafeHtml(String) SanitizesinputHTMLdocumentfor

safedisplayonbrowser.GetSafeHtml(TextReader,Stream)

SanitizesinputHTMLdocumentforsafedisplayonbrowser.

GetSafeHtml(TextReader,TextWriter)

SanitizesinputHTMLdocumentforsafedisplayonbrowser.

Page 172: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

SanitizerClassSanitizerMembersMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 173: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Sanitizer.GetSafeHtmlMethod(String)SanitizerClassSeeAlso

SanitizesinputHTMLdocumentforsafedisplayonbrowser.

Namespace:Microsoft.Security.ApplicationAssembly:HtmlSanitizationLibrary(inHtmlSanitizationLibrary.dll)Version:4.2.0.0

Page 174: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

publicstaticstringGetSafeHtml(

stringinput

)

VisualBasic

PublicSharedFunctionGetSafeHtml(_

inputAsString_

)AsString

VisualC++

public:

staticString^GetSafeHtml(

String^input

)

ParametersinputType:System.StringMaliciousHTMLDocument

ReturnValueAsantiziedHTMLdocument

http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
Page 175: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

RemarksThemethodtransformsandfiltersHTMLofexecutablescripts.AsafelistoftagsandattributesareusedtostripdangerousscriptsfromtheHTML.HTMLisalsonormalizedwheretagsareproperlyclosedandattributesareproperlyformatted.

Page 176: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

SanitizerClassGetSafeHtmlOverloadMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 177: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Sanitizer.GetSafeHtmlMethod(TextReader,Stream)SanitizerClassSeeAlso

SanitizesinputHTMLdocumentforsafedisplayonbrowser.

Namespace:Microsoft.Security.ApplicationAssembly:HtmlSanitizationLibrary(inHtmlSanitizationLibrary.dll)Version:4.2.0.0

Page 178: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

publicstaticvoidGetSafeHtml(

TextReadersourceReader,

StreamdestinationStream

)

VisualBasic

PublicSharedSubGetSafeHtml(_

sourceReaderAsTextReader,_

destinationStreamAsStream_

)

VisualC++

public:

staticvoidGetSafeHtml(

TextReader^sourceReader,

Stream^destinationStream

)

ParameterssourceReaderType:System.IO.TextReaderSourcetextreaderwithmaliciousHTMLdestinationStreamType:System.IO.StreamStreamtowritesafeHTML

http://msdn2.microsoft.com/en-us/library/4dtxwhby
http://msdn2.microsoft.com/en-us/library/8f86tw9e
http://msdn2.microsoft.com/en-us/library/4dtxwhby
http://msdn2.microsoft.com/en-us/library/8f86tw9e
http://msdn2.microsoft.com/en-us/library/4dtxwhby
http://msdn2.microsoft.com/en-us/library/8f86tw9e
http://msdn2.microsoft.com/en-us/library/4dtxwhby
http://msdn2.microsoft.com/en-us/library/8f86tw9e
Page 179: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

RemarksThemethodtransformsandfiltersHTMLofexecutablescripts.AsafelistoftagsandattributesareusedtostripdangerousscriptsfromtheHTML.HTMLisalsonormalizedwheretagsareproperlyclosedandattributesareproperlyformatted.

Page 180: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

SanitizerClassGetSafeHtmlOverloadMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 181: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Sanitizer.GetSafeHtmlMethod(TextReader,TextWriter)SanitizerClassSeeAlso

SanitizesinputHTMLdocumentforsafedisplayonbrowser.

Namespace:Microsoft.Security.ApplicationAssembly:HtmlSanitizationLibrary(inHtmlSanitizationLibrary.dll)Version:4.2.0.0

Page 182: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

publicstaticvoidGetSafeHtml(

TextReadersourceReader,

TextWriterdestinationWriter

)

VisualBasic

PublicSharedSubGetSafeHtml(_

sourceReaderAsTextReader,_

destinationWriterAsTextWriter_

)

VisualC++

public:

staticvoidGetSafeHtml(

TextReader^sourceReader,

TextWriter^destinationWriter

)

ParameterssourceReaderType:System.IO.TextReaderSourcetextreaderwithmaliciousHTMLdestinationWriterType:System.IO.TextWriterTextWritertowritesafeHTML

http://msdn2.microsoft.com/en-us/library/4dtxwhby
http://msdn2.microsoft.com/en-us/library/ywxh2328
http://msdn2.microsoft.com/en-us/library/4dtxwhby
http://msdn2.microsoft.com/en-us/library/ywxh2328
http://msdn2.microsoft.com/en-us/library/4dtxwhby
http://msdn2.microsoft.com/en-us/library/ywxh2328
http://msdn2.microsoft.com/en-us/library/4dtxwhby
http://msdn2.microsoft.com/en-us/library/ywxh2328
Page 183: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

RemarksThemethodtransformsandfiltersHTMLofexecutablescripts.AsafelistoftagsandattributesareusedtostripdangerousscriptsfromtheHTML.HTMLisalsonormalizedwheretagsareproperlyclosedandattributesareproperlyformatted.

Page 184: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

SanitizerClassGetSafeHtmlOverloadMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 185: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Sanitizer.GetSafeHtmlFragmentMethodSanitizerClassSeeAlso

Page 186: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

OverloadList

Name DescriptionGetSafeHtmlFragment(String) SanitizesinputHTML

fragmentforsafedisplayonbrowser.

GetSafeHtmlFragment(TextReader,Stream)

SanitizesinputHTMLfragmentforsafedisplayonbrowser.

GetSafeHtmlFragment(TextReader,TextWriter)

SanitizesinputHTMLfragmentforsafedisplayonbrowser.

Page 187: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

SanitizerClassSanitizerMembersMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 188: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Sanitizer.GetSafeHtmlFragmentMethod(String)SanitizerClassSeeAlso

SanitizesinputHTMLfragmentforsafedisplayonbrowser.

Namespace:Microsoft.Security.ApplicationAssembly:HtmlSanitizationLibrary(inHtmlSanitizationLibrary.dll)Version:4.2.0.0

Page 189: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

publicstaticstringGetSafeHtmlFragment(

stringinput

)

VisualBasic

PublicSharedFunctionGetSafeHtmlFragment(_

inputAsString_

)AsString

VisualC++

public:

staticString^GetSafeHtmlFragment(

String^input

)

ParametersinputType:System.StringMaliciousHTMLfragment

ReturnValueSafeHTMLfragment

http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
http://msdn2.microsoft.com/en-us/library/s1wwdcbf
Page 190: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

RemarksThemethodtransformsandfiltersHTMLofexecutablescripts.AsafelistoftagsandattributesareusedtostripdangerousscriptsfromtheHTML.HTMLisalsonormalizedwheretagsareproperlyclosedandattributesareproperlyformatted.

Page 191: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

SanitizerClassGetSafeHtmlFragmentOverloadMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 192: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Sanitizer.GetSafeHtmlFragmentMethod(TextReader,Stream)SanitizerClassSeeAlso

SanitizesinputHTMLfragmentforsafedisplayonbrowser.

Namespace:Microsoft.Security.ApplicationAssembly:HtmlSanitizationLibrary(inHtmlSanitizationLibrary.dll)Version:4.2.0.0

Page 193: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

publicstaticvoidGetSafeHtmlFragment(

TextReadersourceReader,

StreamdestinationStream

)

VisualBasic

PublicSharedSubGetSafeHtmlFragment(_

sourceReaderAsTextReader,_

destinationStreamAsStream_

)

VisualC++

public:

staticvoidGetSafeHtmlFragment(

TextReader^sourceReader,

Stream^destinationStream

)

ParameterssourceReaderType:System.IO.TextReaderSourcetextreaderwithmaliciousHTMLdestinationStreamType:System.IO.StreamStreamtowritesafeHTML

http://msdn2.microsoft.com/en-us/library/4dtxwhby
http://msdn2.microsoft.com/en-us/library/8f86tw9e
http://msdn2.microsoft.com/en-us/library/4dtxwhby
http://msdn2.microsoft.com/en-us/library/8f86tw9e
http://msdn2.microsoft.com/en-us/library/4dtxwhby
http://msdn2.microsoft.com/en-us/library/8f86tw9e
http://msdn2.microsoft.com/en-us/library/4dtxwhby
http://msdn2.microsoft.com/en-us/library/8f86tw9e
Page 194: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

RemarksThemethodtransformsandfiltersHTMLofexecutablescripts.AsafelistoftagsandattributesareusedtostripdangerousscriptsfromtheHTML.HTMLisalsonormalizedwheretagsareproperlyclosedandattributesareproperlyformatted.

Page 195: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

SanitizerClassGetSafeHtmlFragmentOverloadMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 196: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

Sanitizer.GetSafeHtmlFragmentMethod(TextReader,TextWriter)SanitizerClassSeeAlso

SanitizesinputHTMLfragmentforsafedisplayonbrowser.

Namespace:Microsoft.Security.ApplicationAssembly:HtmlSanitizationLibrary(inHtmlSanitizationLibrary.dll)Version:4.2.0.0

Page 197: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

publicstaticvoidGetSafeHtmlFragment(

TextReadersourceReader,

TextWriterdestinationWriter

)

VisualBasic

PublicSharedSubGetSafeHtmlFragment(_

sourceReaderAsTextReader,_

destinationWriterAsTextWriter_

)

VisualC++

public:

staticvoidGetSafeHtmlFragment(

TextReader^sourceReader,

TextWriter^destinationWriter

)

ParameterssourceReaderType:System.IO.TextReaderSourcetextreaderwithmaliciousHTMLdestinationWriterType:System.IO.TextWriterStreamtowritesafeHTML

http://msdn2.microsoft.com/en-us/library/4dtxwhby
http://msdn2.microsoft.com/en-us/library/ywxh2328
http://msdn2.microsoft.com/en-us/library/4dtxwhby
http://msdn2.microsoft.com/en-us/library/ywxh2328
http://msdn2.microsoft.com/en-us/library/4dtxwhby
http://msdn2.microsoft.com/en-us/library/ywxh2328
http://msdn2.microsoft.com/en-us/library/4dtxwhby
http://msdn2.microsoft.com/en-us/library/ywxh2328
Page 198: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

RemarksThemethodtransformsandfiltersHTMLofexecutablescripts.AsafelistoftagsandattributesareusedtostripdangerousscriptsfromtheHTML.HTMLisalsonormalizedwheretagsareproperlyclosedandattributesareproperlyformatted.

Page 199: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

SanitizerClassGetSafeHtmlFragmentOverloadMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 200: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

UnicodeCharacterEncoderClassMembersSeeAlso

ProvidesHTMLencodingmethods.

Namespace:Microsoft.Security.ApplicationAssembly:AntiXssLibrary40(inAntiXssLibrary40.dll)Version:4.2.0.0

Page 201: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

publicstaticclassUnicodeCharacterEncoder

VisualBasic

PublicNotInheritableClassUnicodeCharacterEncoder

VisualC++

publicrefclassUnicodeCharacterEncoderabstractsealed

Page 202: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

InheritanceHierarchySystem.ObjectMicrosoft.Security.Application.UnicodeCharacterEncoder

http://msdn2.microsoft.com/en-us/library/e5kfa45b
Page 203: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

UnicodeCharacterEncoderMembersMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 204: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

UnicodeCharacterEncoderMembersUnicodeCharacterEncoderClassMethodsSeeAlso

TheUnicodeCharacterEncodertypeexposesthefollowingmembers.

Page 205: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Methods

Name DescriptionMarkAsSafe Markscharactersfromthespecified

languagesassafe.

Page 206: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

UnicodeCharacterEncoderClassMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 207: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

UnicodeCharacterEncoderMethodsUnicodeCharacterEncoderClassSeeAlso

TheUnicodeCharacterEncodertypeexposesthefollowingmembers.

Page 208: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Methods

Name DescriptionMarkAsSafe Markscharactersfromthespecified

languagesassafe.

Page 209: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

UnicodeCharacterEncoderClassMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 210: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

UnicodeCharacterEncoder.MarkAsSafeMethodUnicodeCharacterEncoderClassSeeAlso

Markscharactersfromthespecifiedlanguagesassafe.

Namespace:Microsoft.Security.ApplicationAssembly:AntiXssLibrary40(inAntiXssLibrary40.dll)Version:4.2.0.0

Page 211: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

publicstaticvoidMarkAsSafe(

LowerCodeChartslowerCodeCharts,

LowerMidCodeChartslowerMidCodeCharts,

MidCodeChartsmidCodeCharts,

UpperMidCodeChartsupperMidCodeCharts,

UpperCodeChartsupperCodeCharts

)

VisualBasic

PublicSharedSubMarkAsSafe(_

lowerCodeChartsAsLowerCodeCharts,_

lowerMidCodeChartsAsLowerMidCodeCharts,_

midCodeChartsAsMidCodeCharts,_

upperMidCodeChartsAsUpperMidCodeCharts,_

upperCodeChartsAsUpperCodeCharts_

)

VisualC++

public:

staticvoidMarkAsSafe(

LowerCodeChartslowerCodeCharts,

LowerMidCodeChartslowerMidCodeCharts,

MidCodeChartsmidCodeCharts,

UpperMidCodeChartsupperMidCodeCharts,

UpperCodeChartsupperCodeCharts

)

Parameters

Page 212: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

lowerCodeChartsType:Microsoft.Security.Application.LowerCodeChartsThecombinationoflowercodechartstouse.lowerMidCodeChartsType:Microsoft.Security.Application.LowerMidCodeChartsThecombinationoflowermidcodechartstouse.midCodeChartsType:Microsoft.Security.Application.MidCodeChartsThecombinationofmidcodechartstouse.upperMidCodeChartsType:Microsoft.Security.Application.UpperMidCodeChartsThecombinationofuppermidcodechartstouse.upperCodeChartsType:Microsoft.Security.Application.UpperCodeChartsThecombinationofuppercodechartstouse.

Page 213: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

RemarksThesafelistaffectsallHTMLandXMLencodingfunctions.

Page 214: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

UnicodeCharacterEncoderClassMicrosoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 215: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

UpperCodeChartsEnumerationSeeAlso

ValuesfortheuppersectionoftheUTF8Unicodecodetables,fromUA8E0toUFFFD

Namespace:Microsoft.Security.ApplicationAssembly:AntiXssLibrary40(inAntiXssLibrary40.dll)Version:4.2.0.0

Page 216: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

[FlagsAttribute]

publicenumUpperCodeCharts

VisualBasic

<FlagsAttribute>_

PublicEnumerationUpperCodeCharts

VisualC++

[FlagsAttribute]

publicenumclassUpperCodeCharts

http://msdn2.microsoft.com/en-us/library/dk06fkbc
http://msdn2.microsoft.com/en-us/library/dk06fkbc
http://msdn2.microsoft.com/en-us/library/dk06fkbc
Page 217: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Members

Membername Value DescriptionNone 0 Nocodechartsfrom

theupperregionoftheUnicodetablesaresafe-listed.

DevanagariExtended 1 TheDevanagariExtendedcodetable.

KayahLi 2 TheKayahLicodetable.

Rejang 4 TheRejangcodetable.

HangulJamoExtendedA 8 TheHangulJamoExtended-Acodetable.

Javanese 16 TheJavanesecodetable.

Cham 32 TheChamcodetable.MyanmarExtendedA 64 TheMyanmar

Extended-Acodetable.

TaiViet 128 TheTaiVietcodetable.

MeeteiMayek 256 TheMeeteiMayekcodetable.

HangulSyllables 512 TheHangulSyllablescodetable.

HangulJamoExtendedB 1024 TheHangulJamoExtended-Bcodetable.

CjkCompatibilityIdeographs 2048 TheCJKCompatibilityIdeographscodetable.

Page 218: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

AlphabeticPresentationForms 4096 TheAlphabeticPresentationFormscodetable.

ArabicPresentationFormsA 8192 TheArabicPresentationForms-Acodetable.

VariationSelectors 16384 TheVariationSelectorscodetable.

VerticalForms 32768 TheVerticalFormscodetable.

CombiningHalfMarks 65536 TheCombiningHalfMarkscodetable.

CjkCompatibilityForms 131072 TheCJKCompatibilityFormscodetable.

SmallFormVariants 262144 TheSmallFormVariantscodetable.

ArabicPresentationFormsB 524288 TheArabicPresentationForms-Bcodetable.

HalfWidthAndFullWidthForms 1048576 ThehalfwidthandfullwidthFormscodetable.

Specials 2097152 TheSpecialscodetable.

Page 219: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

Microsoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/
Page 220: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

MicrosoftAntiXSSLibrary

UpperMidCodeChartsEnumerationSeeAlso

ValuesfortheuppermiddlesectionoftheUTF8Unicodecodetables,fromU2DE0toUA8DF

Namespace:Microsoft.Security.ApplicationAssembly:AntiXssLibrary40(inAntiXssLibrary40.dll)Version:4.2.0.0

Page 221: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Syntax

C#

[FlagsAttribute]

publicenumUpperMidCodeCharts

VisualBasic

<FlagsAttribute>_

PublicEnumerationUpperMidCodeCharts

VisualC++

[FlagsAttribute]

publicenumclassUpperMidCodeCharts

http://msdn2.microsoft.com/en-us/library/dk06fkbc
http://msdn2.microsoft.com/en-us/library/dk06fkbc
http://msdn2.microsoft.com/en-us/library/dk06fkbc
Page 222: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

Members

Membername Value DescriptionNone 0 Nocodecharts

fromthelowerregionoftheUnicodetablesaresafe-listed.

CyrillicExtendedA 1 TheCyrillicExtended-Acodetable.

SupplementalPunctuation 2 TheSupplementalPunctuationcodetable.

CjkRadicalsSupplement 4 TheCJKRadicialsSupplementcodetable.

KangxiRadicals 8 TheKangxiRadicialscodetable.

IdeographicDescriptionCharacters 16 TheIdeographicDescriptionCharacterscodetable.

CjkSymbolsAndPunctuation 32 TheCJKSymbolsandPunctuationcodetable.

Hiragana 64 TheHiraganacodetable.

Katakana 128 TheKatakanacodetable.

Bopomofo 256 TheBopomofo

Page 223: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

codetable.HangulCompatibilityJamo 512 TheHangul

CompatbilityJamocodetable.

Kanbun 1024 TheKanbuncodetable.

BopomofoExtended 2048 TheBopomofuExtendedcodetable.

CjkStrokes 4096 TheCJKStrokescodetable.

KatakanaPhoneticExtensions 8192 TheKatakanaPhoneticExtensoinscodetable.

EnclosedCjkLettersAndMonths 16384 TheEnclosedCJKLettersandMonthscodetable.

CjkCompatibility 32768 TheCJKCompatibilitycodetable.

CjkUnifiedIdeographsExtensionA 65536 TheCJKUnifiedIdeographsExtensionAcodetable.

YijingHexagramSymbols 131072 TheYijingHexagramSymbolscodetable.

CjkUnifiedIdeographs 262144 TheCJKUnifiedIdeographs

Page 224: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

codetable.YiSyllables 524288 TheYi

Syllablescodetable.

YiRadicals 1048576 TheYiRadicalscodetable.

Lisu 2097152 TheLisucodetable.

Vai 4194304 TheVaicodetable.

CyrillicExtendedB 8388608 TheCyrillicExtended-Bcodetable.

Bamum 16777216 TheBamumcodetable.

ModifierToneLetters 33554432 TheModifierToneLetterscodetable.

LatinExtendedD 67108864 TheLatinExtended-Dcodetable.

SylotiNagri 134217728 TheSylotiNagricodetable.

CommonIndicNumberForms 268435456 TheCommonIndicNumberFormscodetable.

Phagspa 536870912 ThePhags-pacodetable.

Saurashtra 1073741824 TheSaurashtracodetable.

Page 225: Microsoft AntiXSS Library - Documentation & Help · Microsoft AntiXSS Library Using AntiXSS as the default ASP.NET encoder.NET 4.0 introduced the ability to swap the default encoding

SeeAlso

Microsoft.Security.ApplicationNamespace

(c)2008,2009,2010,2011MicrosoftCorporation.Allrightsreservered.

http://wpl.codeplex.com/

Microsoft Dynamics NAV 2015 Development Courseware · Microsoft Dynamics NAV 2015 Developer 2 Module 1 - Microsoft Dynamics NAV Development Environment 1. Non-default property values

Setting Up a Paper in APA Style Using Microsoft Word … 1 Setting Up a Paper in APA Style Using Microsoft Word 2007 Open Microsoft Word 2007. By default

Powerpoint: Modify default Microsoft Templates

Business Benefits From Microsoft SQL Server Business ... › sites › default › files › benefitsbi.pdf · Business Benefits From Microsoft SQL Server Business Intelligence

Microsoft Visual C# Default Keybindings...Microsoft ® Visual C# ® Default Keybindings Build.BuildSolution Build.BuildSelection F6 or CTRL + SHIFT + B SHIFT + F6 Builds all the projects

1 MAKING "LIBREOFFICE" DEFAULT TO THE.doc,.xls, AND.ppt FILE FORMATS OF "MICROSOFT OFFICE.."

(ffice365.tif) - IT Nerb GmbHit-nerb.de/sites/default/files/office365.pdf · Microsoft Microsoft Deutschland GmbH Konrad-Zuse-Str. 1 85716 Unterschleißheim Office 365 Microsoft Deutschland

Microsoft PowerPoint 2010 Product Guide - Web CMSwebcms.uct.ac.za/sites/default/files/image_tool/images/286/Guide... · Microsoft PowerPoint 2010 Product Guide . Introduction

Microsoft Excel 2010 Part 2: Intermediate Exceltraining.calstatela.edu/sites/default/files/groups/Information Technology Services... · Microsoft Excel 2010 Part 2: Intermediate Excel

Microsoft Default Settings for SBS2003

geomorphology.org.ukgeomorphology.org.uk/sites/default/files/geom_tech... ·  · 2017-06-06Title: Microsoft Word - 1.5.5_GPR.docx

businesses deliver TODAY with Microsoft Dynamics CRM Online › sites › default › files › ... · Microsoft Dynamics CRM Online with an integration to Microsoft Dynamics ERP

Changing the Default Font in Microsoft Word

Microsoft 70-768 Exam · Microsoft 70-768 Exam . Leading the way in IT testing and certification tools, Scenario: Box 1, Processing option: Default . Process Default detects the process

Microsoft Visual C# Default Key Bindings...Microsoft ® Visual C#® Default Key BindingsEditing Edit.CollapseTo-Defi nitions CTRL + M, O Collapses declaration bodies to provide a

Документ Microsoft Word - msu.rulimu.msu.ru/sites/default/files/nelinejnyij_mir_t7_7... · 2015-08-06 · Microsoft Word - Документ Microsoft Word.doc Author: oleg

New Microsoft Office Word Documentpallisanchaybank.portal.gov.bd/sites/default/files/... · Title: Microsoft Word - New Microsoft Office Word Document Author: User Created Date: 7/6/2017

New Microsoft Office Word Documentppqs.gov.in/sites/default/files/9_3_chemistry_checklist.pdf · 1 day ago · Title: Microsoft Word - New Microsoft Office Word Document.docx Author:

Mitel MiVoice Office 400 & Microsoft Lync Brochure - Letterd3zs5oljjs68i.cloudfront.net/sites/default/files/Mitel-MiVoice... · MiVoice Office 400 & Microsoft Lync MS Lync 2013 Direct

Hands-On Microsoft Windows Server 2008fac.ksu.edu.sa/sites/default/files/ch01-Updated_0.pdf · •Microsoft Metadirectory Services –Facilitate multiple directory services to track

FSX Mooney Bravo - Freeromain.soullier.free.fr/Checklists/FSX Mooney Bravo.pdf · Mooney Bravo Microsoft Flight Simulator X Aircraft : Default Mooney Bravo Panel : Default Mooney

Microsoft® Visual Basic® Default Keybindings - StudentGuru

Hardening Microsoft Office 2013 - Cyber › sites › default › files › 2020-01...Microsoft PowerPoint, Microsoft Project, Microsoft Visio and Microsoft Word. Group Policy Setting

SALES ORDER PROCESSING MICROSOFT DYNAMICS …learning.gaa.ie/sites/default/files/GP10_SOP.pdf · SALES ORDER PROCESSING MICROSOFT DYNAMICS GP ... Sales Distribution Entry Transaction

Microsoft Hosted Exchange 2010info.savvisdirect.com › sites › default › files › ...Microsoft Hosted Exchange purchase from CenturyLink. ActiveSync. ActiveSync service hosted

Microsoft Excel 2011 - Eastman School of Music · PDF fileFormulas Tab ... Appearance of Microsoft Excel Microsoft Excel allows you to create spreadsheets much like paper ... The default

Migrating to Microsoft Exchange with Outlook 2007 and ...ist.mit.edu › sites › default › files › site_images › services › training › ou… · v6.2 . Migrating to Microsoft

Microsoft SharePoint 2010 - FlowPointflowpoint.ru/sites/default/files/Microsoft_SharePoint_2010_RU.pdf · сматривать и редактировать документы Office,

An Epic Tale Of AntiXSSLibrary Microsoft AntiXSS Library v4.2.1 CSC699 Hans Hagen 5/29/12 By Hans Hagen 5/29/12

Packaging & Deploying in Microsoft - uni-potsdam.de · and application‘s (default) ... (.msi) Assemblies deployed ... Packaging & Deploying in Microsoft .NET 07.07.2003 31 Hasso-Plattner-Institut

Microsoft What’s New in Office - The CFReDS Project · Microsoft® What’s New in Office ™ 2007 ... The Ribbon is displayed by default when you open Microsoft Word 2007,

Microsoft PowerPoint 2013 Fundamentals Manualtechnology.pitt.edu/sites/default/files/documents/migrated/Training... · Microsoft PowerPoint 2013 Fundamentals ... Microsoft PowerPoint

Microsoft SQL Server Administration - Univerzita …siret.ms.mff.cuni.cz/sites/default/files/doc/david.hoksza/...Microsoft SQL Server Administration Partitioning ... Build “multi-filegroup”

Microsoft Project 2013 Basic Course 02 - Working with ... · Microsoft Project 2013 provides three base calendars: Standard, 24 Hours, and Night Shift. 3. B False. By default, Microsoft

Certificate This Certificate accredits that of Microsoft ...staff.uny.ac.id/sites/default/files/pendidikan... · Microsoft Certified Trainer MM, MT has successfully completed the