MVC 输入中的 Html 编码
我正在研究 NerdDinner，我对以下部分有点困惑...
首先，他们添加了一个用于创建新晚餐的表单，其中包含一堆文本框，如下所示：
<%= Html.TextArea("Description") %>
然后他们显示两个将表单输入绑定到模型的方法：
[AcceptVerbs(HttpVerbs.Post)]
public ActionResult Create() {
Dinner dinner = new Dinner();
UpdateModel(dinner);
...
}
或：
[AcceptVerbs(HttpVerbs.Post)]
public ActionResult Create(Dinner dinner) { ... }
好的，太好了，到目前为止，一切看起来都非常简单。
过了一会儿他们说：
始终保持偏执很重要 关于接受任何用户时的安全性 输入，当 绑定对象以形成输入。你 应该小心 HTML 将任何用户输入的值编码为 避免 HTML 和 JavaScript 注入 攻击
啊？ MVC 为我们管理数据绑定。你应该在哪里/如何进行 HTML 编码？
I'm working through NerdDinner and I'm a bit confused about the following section...
First they've added a form for creating a new dinner, with a bunch of textboxes delcared like:
<%= Html.TextArea("Description") %>
They then show two ways of binding form input to the model:
[AcceptVerbs(HttpVerbs.Post)]
public ActionResult Create() {
Dinner dinner = new Dinner();
UpdateModel(dinner);
...
}
or:
[AcceptVerbs(HttpVerbs.Post)]
public ActionResult Create(Dinner dinner) { ... }
Ok, great, that all looks really easy so far.
Then a bit later on they say:
It is important to always be paranoid
about security when accepting any user
input, and this is also true when
binding objects to form input. You
should be careful to always HTML
encode any user-entered values to
avoid HTML and JavaScript injection
attacks
Huh? MVC is managing the data binding for us. Where/how are you supposed to do the HTML encoding?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您通常（但并非总是）希望在将值写出之前对其进行 HTML 编码，通常是在视图中，但也可能从控制器中。
这里有一些信息： http://weblogs.asp.net/scottgu/archive/2010/04/06/new-lt-gt-syntax- for-html-encoding-output-in-asp-net-4-and-asp-net-mvc-2.aspx
You generally (but not always) want to HTML encode the values before writing them out, typically in your views, but possibly from the controller as well.
Some info here: http://weblogs.asp.net/scottgu/archive/2010/04/06/new-lt-gt-syntax-for-html-encoding-output-in-asp-net-4-and-asp-net-mvc-2.aspx