如何保护用户输入中的字符串
我们有一个网站，用户可以有理由拒绝其他用户的某些内容。原因会通过电子邮件发送给其他用户。
可以向其他用户发送哪些字符？ 我不会对不需要的字符进行正则表达式搜索，而只想在原因中保留“潜在”“安全”字符。
例如，原因：
"Hello <b>Dear User B"
将转换为：
"Hello bDear User B"
目前我只是在 char 数组上执行“Where”，并通过
char.IsLetterOrDigit || char.IsPunctuation || char.IsWhiteSpace
是否有更好的技术来定义我的“安全”条件？
We have a Website where a user can reject something from another user with a reason. The reason is sent to the other user via email.
What characters can be sent to the other user?
I am not going to do a regex search for unwanted characters but rather only want to keep "potentially" "safe" characters in the reason.
For example the reason:
"Hello <b>Dear User B"
Would be transformed to:
"Hello bDear User B"
Currently i'm just doing a "Where" on the char array and define my "safe" conditions via
char.IsLetterOrDigit || char.IsPunctuation || char.IsWhiteSpace
Are there any better techniques?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
您完全可以在电子邮件正文中使用 HTML。这将允许更漂亮的格式。在通过电子邮件发送用户输入之前，您可以在用户输入上使用 AntiXSS 库，以过滤掉 HTML 中的危险内容（例如
You could perfectly fine use HTML in email body. This will allow for prettier formatting. You could use the AntiXSS library on the user input before sending it by email to filter dangerous things out of the HTML (things like
<script>tags for example).您可以尝试在 C# 中使用 HttpEncoder 类，并在字符串上使用 htmlEncode 方法。
这将使所有 < >转换为相当于 < 的 html等等。返回一个安全字符串。
尽管它看起来会很丑，所有的<<以及电子邮件中类似的内容，您可以将其视为一种潜在的安全解决方法。
如果您也将注释插入数据库，我不建议使用此方法，因为它不是 sql 注入证明。在这种情况下，您可以使用 htmlencode 发送电子邮件并使用参数插入数据库。
you could try using the HttpEncoder class in C# with the htmlEncode method on your string.
This will turn all < > into the html equivalent of < ; etc. Returning a safe string.
Though it will look ugly with all the < ; and kinda-like-stuff in the email, you could see it as a potentially safe-work around.
If you are inserting the comments into a database as well I wouldn't recommend using this method, as it's not sql-injection proof. In that case you can use the htmlencode for sending emails and use parameters with inserting to the database.
如果您认为 ascii 值 32 到 126 的字符对您来说是安全的，那么您可以使用
if you think characters having ascii value 32 to 126 are safe for you, Then you can use