Hi all,

Can we use the Antixss library with WYSIWYG editors output?

If Yes please let me know how it is possible to do that.

Same question from me. I want to integarate it with WYSIWYG editor but don't know how to prevent malicious scripts but still allow HTML tags.

I hope there is someone can answer it...

Thanks b4

Add me to the list of those who want an answer to this question.

I'd also like to know which WYSIWYG textbox controls you guys are using, and if there is a better "home brewed" solution for ASP.Net apps.

Oh and also it has to work in a hosted environment.

Hi,

You sure can use the antiXSS library with most editors.

The most popular editors are probably FCKEditor and FreeTextBox.

Get the latest version of the Microsoft Anti-Cross Site Scripting Library here

These editors will require that you set the ValidateRequest parameter in @ Page  to false. This is obviously asking for trouble so use the AntiXss library to encode all input on the page especially any input from the WSIWYG editor. There is a great tutorial here: http://msdn.microsoft.com/en-us/library/aa973813.aspx

Enjoy.

adman666:

Hi,

You sure can use the antiXSS library with most editors.

The most popular editors are probably FCKEditor and FreeTextBox.

Get the latest version of the Microsoft Anti-Cross Site Scripting Library here

These editors will require that you set the ValidateRequest parameter in @ Page  to false. This is obviously asking for trouble so use the AntiXss library to encode all input on the page especially any input from the WSIWYG editor. There is a great tutorial here: http://msdn.microsoft.com/en-us/library/aa973813.aspx

Enjoy.

 Hum... would you give the real code example of using AntiXSS with WYSIWYG editor from encoding input to displaying the encoded input that will eliminate the malicius script and keep the safe HTML there?

For me, when I encode the input, it will also encode the HTML tags.... is there API to set allowed HTML tags?

adman666:

Hi,

You sure can use the antiXSS library with most editors.

The most popular editors are probably FCKEditor and FreeTextBox.

Get the latest version of the Microsoft Anti-Cross Site Scripting Library here

These editors will require that you set the ValidateRequest parameter in @ Page  to false. This is obviously asking for trouble so use the AntiXss library to encode all input on the page especially any input from the WSIWYG editor. There is a great tutorial here: http://msdn.microsoft.com/en-us/library/aa973813.aspx

Enjoy.

 Hum... would you give the real code example of using AntiXSS with WYSIWYG editor from encoding input to displaying the encoded input that will eliminate the malicius script and keep the safe HTML there?

For me, when I encode the input, it will also encode the HTML tags.... is there API to set allowed HTML tags?

AntiXss.GetSafeHtmlFragment
and
AntiXss.GetSafeHtml

but when I try to call these functions I get an exception saying "SafeHtml Failed".

It would be great to get an aswer to this as it seems alot of people have the same issue,