StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>The ASP.NET class that validates requests is <code>System.Web.CrossSiteScriptingValidation</code>, and the method you want is <code>IsDangerousString</code>. Unfortunately, both are marked <code>internal</code>, so you can't access them directly. You have several options:</p> <p><strong>Option 1:</strong> Call <code>IsDangerousString</code> via Reflection. However, Microsoft could change the method at any time, which would break your applicaton.</p> <p><strong>Option 2:</strong> Decompile <code>IsDangerousString</code> and copy it to your own application. See the code below.</p> <p><strong>Option 3:</strong> Call <a href="http://msdn.microsoft.com/en-us/library/system.web.security.membership.generatepassword.aspx"><code>Membership.GeneratePassword</code></a>. This returns a password that is guaranteed to pass request validation.</p> <p>Excerpts from the ASP.NET <code>CrossSiteScriptingValidation</code> class (via .NET Reflector):</p> <pre><code>private static char[] startingChars = new char[] { '<', '&' }; internal static bool IsDangerousString(string s, out int matchIndex) { matchIndex = 0; int startIndex = 0; while (true) { int num2 = s.IndexOfAny(startingChars, startIndex); if (num2 < 0) { return false; } if (num2 == (s.Length - 1)) { return false; } matchIndex = num2; char ch = s[num2]; if (ch != '&') { if ((ch == '<') && ((IsAtoZ(s[num2 + 1]) || (s[num2 + 1] == '!')) || ((s[num2 + 1] == '/') || (s[num2 + 1] == '?')))) { return true; } } else if (s[num2 + 1] == '#') { return true; } startIndex = num2 + 1; } } private static bool IsAtoZ(char c) { return (((c >= 'a') && (c <= 'z')) || ((c >= 'A') && (c <= 'Z'))); } </code></pre>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload