.NET libraries to sanitize input?

问题:

Are there any thoroughly tested .NET libraries out there to sanitize input from things like script/sql injection?

回答1:

SQL injection and Cross-Site Scripting (a.k.a. XSS or Script Injection) are different problems.

1) SQL Injection is very easy, always use parametrized queries (SQLParameter) and try really hard to NEVER do sp_exec @query within T-SQL stored procedures. .Net parametrized queries will not protect against this second order injection.

2) XSS is more difficult to universally mitigate since there are so many places that JavaScript can be inserted into HTML documents. The recommendations to use AntiXSS for encoding user data is right on. Use this library before inserting user data into output documents. Unfortunately, if you are using ASP.Net server controls encoding all data may lead to double-encoding and display artifacts. This happens because some control properties encode data while others don't. Refer to this table to find out the properties encoded by default. Use Anti-XSS before assigning to any properties that don't encode.

回答2:

I like to use the Microsoft AntiXSS library. It's free and pretty easy to use.

For SQL injection, I always use parameters. Again, they are easy to use and I don't like trying to escape special characters. It's a recipe for disaster if you ask me.

回答3:

Use parameterised commands, rather than trying to sanitize strings, to guard against SQL Injection.

回答4:

AntiXSS can be used for preventing XSS attacks.

回答5:

I have used MS Anti XSS library. It is very useful and easy to use. Try it yourself, you will enjoy. Current version is 4.0.

回答6:

If you are using ASP.NET 4.5 you can now use the AntiXSS features that ship in the framework.

These are the portions of the external AntiXSS Library that have been incorporated into ASP.NET 4.5:

• HtmlEncode, HtmlFormUrlEncode, and HtmlAttributeEncode
• XmlAttributeEncode and XmlEncode
• UrlEncode and UrlPathEncode (new)
• CssEncode