Cross-Site Scripting & sqlDataReader

[vineetbatta]

I am using sqlDataReader for Showing data from the Data base.
But if the Data from sql is having tags like <script>alert()</script> then it shows an alert box while binding.

Is there any way of suppressing it this ..... ???? or is it a flaw?

regards
Vineet Batta

[Ken Schaefer]

Use HTMLEncode() when outputting the data.

It replaces things like < with &lt; etc. It is not a bug - you are using
reserved characters in your text, and you need to replace those reserved
characters with the appropriate HTML Entities that are defined in the HTML
specifications. HTMLEncode() does this for you.

Cheers
Ken

"vineetbatta" <anonymous@discussions.microsoft.com> wrote in message
news:B2FE8EF1-A473-458F-9659-96A059BED429@microsoft.com...
: I am using sqlDataReader for Showing data from the Data base.
: But if the Data from sql is having tags like <script>alert()</script> then
it shows an alert box while binding.
:
: Is there any way of suppressing it this ..... ???? or is it a flaw?
:
: regards
: Vineet Batta
:

[avnrao]

use HttpServerUtility.UrlEncode while binding.

Av.
"vineetbatta" <anonymous@discussions.microsoft.com> wrote in message
news:B2FE8EF1-A473-458F-9659-96A059BED429@microsoft.com...

>I am using sqlDataReader for Showing data from the Data base.
> But if the Data from sql is having tags like <script>alert()</script> then
> it shows an alert box while binding.
>
> Is there any way of suppressing it this ..... ???? or is it a flaw?
>
> regards
> Vineet Batta
>

[Ken Schaefer]

You mean HTMLEncode()?

URLEncode() is for formatting text to be placed into a URL (eg as part of a
querystring)

Cheers
Ken

"avnrao" <avn@newsgroups.com> wrote in message
news:eI$54TyNEHA.1396@TK2MSFTNGP10.phx.gbl...
: use HttpServerUtility.UrlEncode while binding.
:
: Av.
: "vineetbatta" <anonymous@discussions.microsoft.com> wrote in message
: news:B2FE8EF1-A473-458F-9659-96A059BED429@microsoft.com...
: >I am using sqlDataReader for Showing data from the Data base.
: > But if the Data from sql is having tags like <script>alert()</script>
then
: > it shows an alert box while binding.
: >
: > Is there any way of suppressing it this ..... ???? or is it a flaw?
: >
: > regards
: > Vineet Batta
: >
:
:

[avnrao]

thats true. its HTMLEncode().

Av.

"Ken Schaefer" <kenREMOVE@THISadOpenStatic.com> wrote in message
news:OfdW3eyNEHA.3492@TK2MSFTNGP10.phx.gbl...

> You mean HTMLEncode()?
>
> URLEncode() is for formatting text to be placed into a URL (eg as part of
> a
> querystring)
>
> Cheers
> Ken
>
> "avnrao" <avn@newsgroups.com> wrote in message
> news:eI$54TyNEHA.1396@TK2MSFTNGP10.phx.gbl...
> : use HttpServerUtility.UrlEncode while binding.
> :
> : Av.
> : "vineetbatta" <anonymous@discussions.microsoft.com> wrote in message
> : news:B2FE8EF1-A473-458F-9659-96A059BED429@microsoft.com...
> : >I am using sqlDataReader for Showing data from the Data base.
> : > But if the Data from sql is having tags like <script>alert()</script>
> then
> : > it shows an alert box while binding.
> : >
> : > Is there any way of suppressing it this ..... ???? or is it a flaw?
> : >
> : > regards
> : > Vineet Batta
> : >
> :
> :
>
>