Do you use HtmlEncode during input or output?

Question

When do you call Microsoft.Security.Application.AntiXss.HtmlEncode? Do you do this when the user transmits information or does it when you display information?

What about basic things like first name, last name, city, state, zip code?

Answer 1

You do this when you display information. Save the original when it was entered, convert it to display on the web page. Let's say you showed it in some other way, for example, exported it to Excel. In this case, you want to export the saved original.

Encode each line.

Answer 2

, , , , . , ( & - ).

, , . , , . : "us" , "ss" .

usFirstName = getUserInput('firstName')

ssFirstName = cleanString(usFirstName);

, , (, ..) - .

Answer 3

. , HTML, , , , .

, , . , Microsoft AntiXss, homebrew, HTML- .

( ), , . .

Answer 4

, . , , . , .

, , HTML, HTTP, .. - , , . , ASP.NET , System.Web.UI.WebControls.Button, , System.Web.UI.WebControls.Literal Text. jQuery , .innerText(), , .innerHtml().