HTML 编码 服务器端与客户端
我想在我的页面上启用评论发布，因此我需要在发送帖子并将其插入数据库之前执行一些 html 编码。
理想的一面是什么？
服务器端（我使用 asp.net）还是客户端（javascript）？
I want to enable comment posting on my page, so i need to execute some html encoding before post is sent and inserted into a database.
What is the ideal side for this?
Sever side(I work with asp.net) or client side (javascript)?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
如果您的意思是清理用户输入，那么您可以安全地执行此操作的唯一地方就是服务器端。您无法确定客户端是否已完成任何操作，绕过客户端代码太容易了。
这就像数据验证：在客户端进行数据验证（例如，确保表单的关键字段填充了有效值）很好，因为即时反馈可以带来良好的用户体验，但这样做并不能替代在服务器上执行此操作，因为绕过客户端验证非常容易。
但是，通过清理输入，您甚至不想尝试在客户端执行此操作；假设它未经清理并在服务器上对其进行清理。
在 ASP.Net 中，如果您要清理的输入是稍后要在 HTML 页面中显示的字符串，并且您希望确保它不包含自己的 HTML 标记，则可以使用
HttpServerUtility.HtmlEncode对字符串进行编码（基本上，将<变为<等）。If you mean sanitizing the user input, the only place you can do that safely is server-side. You can't be sure that anything has been done client-side, it's too easy to bypass client-side code.
It's like data validation: It's nice to do data validation (making sure key fields of a form are filled in with valid values, for instance) on the client because the immediate feedback makes for a good user experience, but doing so is not a substitute for doing it on the server, because it's trivially easy to bypass the client-side validation.
But with sanitizing input, you don't even want to try to do that client-side; assume it's un-sanitized and sanitize it on the server.
In ASP.Net, if the input you're sanitizing is a string you're later going to display in an HTML page and you want to ensure that it doesn't contain HTML tags of its own, you can use
HttpServerUtility.HtmlEncodeto encode the string (basically, turning<into<and such).毫无疑问，肯定是服务器端。
但是，我会在输出到浏览器之前对输入进行编码，而不是在输入到数据库之前。
如果您使用 ASP .NET MVC，则可以使用帮助程序方法。
如果您在 NET 4 框架中使用 ASP .NET（Webforms 或 MVC），则可以使用新语法。
Without a doubt, definitely server side.
However, I would encode the input before output to the browser instead of before input to the database.
If you are using ASP .NET MVC you can use the helper method.
If you are using ASP .NET (webforms or MVC) in the NET 4 framework, you can use the new syntax.
当然，您应该使用
服务器端。如果您在客户端执行此操作，用户可以轻松获取您正在使用的加密。
如果是服务器端的话应该更安全。
Surely you should go with
server side.If you do it with client side, Users can easily get the encryption what you are using.
If it is a server side.It should be more secure.
一种方法是，无论用户
在输出标题中输入什么内容，都将页面保留为 UTF-8，并将数据库也保留为 unicode。您永远无法确定用户将输入什么。
每个数据库堆栈还提供了转义可能的恶意内容的方法，例如 PHP 中的
mysql_real_escape_stringMySQL 函数。A way to do it is to keep your page in UTF-8 for whatever users may be entering with
in the header of output and keep the database in unicode as well. You can never be sure what users are going to input.
Every database stack also delivers the means to escape possibly malicious content, e.g.
mysql_real_escape_stringMySQL function in PHP.