Solved

HTML encoding with MVC2?

Posted on 2010-09-24
6
796 Views
Last Modified: 2012-05-10
In the Nerd Dinner Chapter 1 I read "You should be careful to always HTML-encode any user-entered values to avoid HTML and JavaScript injection attacks"

Please explain how HTML encoding works and what tools are avilable.  Also, a simple example of what an HTML or JavaScript injection attack would be great.

Thanks,
newbieweb
0
Comment
Question by:newbieweb
  • 2
  • 2
  • 2
6 Comments
 
LVL 40

Assisted Solution

by:gurvinder372
gurvinder372 earned 150 total points
ID: 33752946
http://robin.mytechtip.com/2009/02/04/encode-decode-html-in-java/

see the thing is, if my response/request is having javascript in it, and my code is evaluating the string somewhere (say using eval() method), then it can possibly lead to security lapse and other surprising behaviors (hope you understood :))
http://www.w3schools.com/jsref/jsref_eval.asp
0
 

Author Comment

by:newbieweb
ID: 33752981
Is there any way you could give me a tiny example of bad HTML that gets "fixed" by some encoder?  I don't yet understand what an eval() method would look for or change to solve the problem.
0
 
LVL 40

Assisted Solution

by:gurvinder372
gurvinder372 earned 150 total points
ID: 33753013
0
Highfive + Dolby Voice = No More Audio Complaints!

Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

 
LVL 20

Accepted Solution

by:
ChristoferDutz earned 350 total points
ID: 33753026
Encoding replaces any special characters with codes. This allows the user to send complex content using simple ASCII charset. For example there is URL-Encoding in which characters that are not allowed in URLs with codes ... " " --> "%20" (Spaces are replaced by "%20" ... the % sign indicates the beginning of a code followed by two chars defining the encoded value). Another conversion is the conversion of HTML entites (The "<" char is escaped by "<" (The & char indicating the beginning of a code and the ";" indicating the end of it).

By encoding a string, you can "disable" its meaning (In Xml for example the "<" and ">" signs are special as they indicate tags. By escaping them to "<" and ">" the browser can treat them as normal text.

This is where JavaScript injection can become dangerous: .. immagine you have a login screen and if the login fails you display "Login: {here comes the value you entered} invalid!" (You output the text entered in the response. If somebody enters "Paul" and the user was invalid then it outputs "Login: Paul invalid!" ... but if an evil person enters "Paul
0
 
LVL 20

Assisted Solution

by:ChristoferDutz
ChristoferDutz earned 350 total points
ID: 33753041
Grrrrr ... good example of escaping ;-) ... the sencance should be:
"By encoding a string, you can "disable" its meaning (In Xml for example the "<" and ">" signs are special as they indicate tags. By escaping them to "& l t ;" and "& g t ;" the browser can treat them as normal text."
0
 

Author Closing Comment

by:newbieweb
ID: 33753079
Thanks. That helps.
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Foreword (July, 2015) Since I first wrote this article, years ago, a great many more people have begun using the internet.  They are coming online from every part of the globe, learning, reading, shopping and spending money at an ever-increasing ra…
Building a website can seem like a daunting task to the uninitiated but it really only requires knowledge of two basic languages: HTML and CSS.
In this tutorial viewers will learn how to code links for mobile sites that, once clicked, send a call or text to a specified number. For a telephone link (once clicked, calls a number), begin with a normal "<a href=" link tag. For the href, specify…
In this tutorial viewers will learn how to embed videos in a webpage using HTML5. Ensure your DOCTYPE declaration is set to HTML5: "<!DOCTYPE html>": Use the <video> tag to insert a video. Define the src as the URL of your video; this is similar to …

706 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now