Online Html Encoder

I just ran across a question with an answer suggesting the AntiXss library to avoid cross site scripting. Sounded interesting, reading the msdn blog, it appears to just provide an HtmlEncode() method. But I already use HttpUtility.HtmlEncode().

Why would I want to use AntiXss.HtmlEncode over HttpUtility.HtmlEncode?

Indeed, I am not the first to ask this question. And, indeed, Google turns up some answers, mainly

• A white-list instead of black-list approach
• A 0.1ms performance improvement

Well, that's nice, but what does it mean for me? I don't care so much about the performance of 0.1ms and I don't really feel like downloading and adding another library dependency for functionality that I already have.

Are there examples of cases where the AntiXss implementation would prevent an attack that the HttpUtility implementation would not?

If I continue to use the HttpUtility implementation, am I at risk? What about this 'bug'?

This is a very basic HTML snippet I have:

<pre>    <code class="language-java">        import java.util.List;        public class Foo {            public void foo(List<List<Integer>> bar) {            }        }    </code></pre>

Where I expect to see the following when opening in a browser:

import java.util.List;public class Foo {    public void foo(List<List<Integer>> bar) {    }}

However something breaks in the parameter list of the method and what gets rendered is:

import java.util.List;public class Foo {    public void foo(List> bar) {    }}

What am I missing? Isn't it enough to be in code tag to hint the browser not to interpret anything inside as HTML? Or is this a different problem?

Every time a user posts something containing < or > in a page in my web application, I get this exception thrown.

I don't want to go into the discussion about the smartness of throwing an exception or crashing an entire web application because somebody entered a character in a text box, but I am looking for an elegant way to handle this.

Trapping the exception and showing

An error has occurred please go back and re-type your entire form again, but this time please do not use <

doesn't seem professional enough to me.

Disabling post validation (validateRequest="false") will definitely avoid this error, but it will leave the page vulnerable to a number of attacks.

Ideally: When a post back occurs containing HTML restricted characters, that posted value in the Form collection will be automatically HTML encoded.So the .Text property of my text-box will be something & lt; html & gt;

Is there a way I can do this from a handler?

I use the <pre> tag in my blog to post code. I know I have to change < to < and > to >. Are any other characters I need to escape for correct html?

I want to convert & to &, " to " etc.Is there a function in c# that could do that without writing all the options manually?