对于处理发布评论的操作，我已将 ValidateInput 属性设置为 false。我使用 html.encoding 通过使用此语法 <%:... %> 重新显示评论
我在评论框中发布了以下代码，并且评论确实按原样发布脚本标签完好无损，但没有实际警报。这是可以接受的，对吧？
<script type="text/javascript"> alert("t"); </script>
现在，我知道我仍然需要提防与 URL 相关的攻击，但是对于重新显示输入，这种方法足够安全吗？
编辑：评论是我唯一允许使用“<”之类的字符的地方。大多数其他输入框仅是字母数字。
I've set ValidateInput attribute to false for actions that deal with posting comments. I'm using html.encoding by using this syntax <%:... %> to redisplay the comment
I posted the following code in the commentbox, and the comment did get posted as it is with script tags intact but no actual alert. That is acceptable, right?
<script type="text/javascript"> alert("t"); </script>
Now, I know I need to still watch out for URL-related attacks, but for re-displaying input, is this approach safe enough?
Edit: Comment is the only place where I'm even allowing characters like "<". Most other input boxes are alphanumeric only.
发布评论
评论（1）
是的你的方法是安全的，事实上你使用 实际上是
<%:意味着数据库中存储的内容并不重要，值是在浏览器中呈现时进行编码，因此如果您查看呈现评论的页面的 html 源代码，您会发现& ;lt;script...浏览器不会将其解释为需要执行的事情。作为旁注：尽管您应该始终执行当前正在执行的操作，以确保这些注释永远不会逐字呈现在浏览器中（无需先对其进行编码），但减轻风险的最安全方法是永远不要让它们获取首先就通过了服务器端验证。但是，想要将代码保存在数据库中存在有效的用例 - 因此它确实取决于您的用例（您尚未提供）
Yes your approach is safe, the fact that you're using the
<%:means that it doesn't matter what is stored in the database, the value with be encoded when rendered in the browser, so if you look at the html source of the page that is rendering your comment, you'll see that the<script...is actually a<script...which won't be interpreted by the browser as something that needs to be executed.As a side note: Although you should always do what you're currently doing to make sure these comments are never rendered in the browser verbatim (without encoding them first), the safest way to mitigate risk is to never let them get past your server-side validation in the first place. However there are valid use cases for wanting to save code in your database - so it does depend on your use case (which you haven't supplied)