msi安装程序,安装之后,安装目录下有以下文件
AntiXSS.chm 包括类库的操作手册参数说明
HtmlSanitizationLibrary.dll 包含Sanitizer类(输入白名单)
AntiXSSLibrary.dll 包含Antixss,Encoder类(输出转义)
使用时在工程内添加引用HtmlSanitizationLibrary.dll 和AntiXSSLibrary.dll
导入命名空间using Microsoft.Security.Application;
1、输入白名单
调用Sanitizer.GetSafeHtmlFragment方法即可,url_c未过滤后的干净字串
url = Request.QueryString["url"];
url_c = Sanitizer.GetSafeHtmlFragment(url);
Response.Write(url_c);
2、输出转义
//HTML内容编码
html_cont = Encoder.HtmlEncode(url);
//html_cont = url;
//HTML属性编码
input1.Value = Encoder.HtmlAttributeEncode(url);
//input1.Value = url;
//对js进行编码
url_c = Encoder.JavaScriptEncode(url);
//url_c = url;
//URL编码
img1.Src = Encoder.UrlEncode(url);
//img1.Src = url;
//XML属性编码
isbn = Encoder.XmlAttributeEncode(Request.QueryString["isbn"]);
//XML内容编码
price = Encoder.XmlEncode(Request.QueryString["price"]);
price = Request.QueryString["price"];
参见:http://www.2cto.com/Article/201107/95175.html
http://www.cnblogs.com/shanyou/archive/2009/07/16/1524515.html
但是不能检查js数据,这篇文章有解决办法:http://blog.csdn.net/cassaba/article/details/21094011