What ASP.NET commands can lead to unsafe code?

Question

Personally, I am trying to write safe ASP.NET code. However, I became quite paranoid with respect to the code that I am writing as I worked for the Registrar (high fraud targets). Are there any ASP.NET functions that I should look at with utmost care (except for SQL access - I know enough not to execute dynamic SQL).

Answer 1

This is an excellent MSDN article: Security Practices: ASP.NET 2.0 Security Practices at a Glance .

Excerpts:

How to prevent cross-site scripting

. , , , . HttpUtility.HtmlEncode , , , cookie , . - / . , .

Response.Write(HttpUtility.HtmlEncode(Request.Form["name"]));

URL, , HttpUtility.UrlEncode URL, .

Response.Write(HttpUtility.UrlEncode(urlString));

, HTML-, - , ASP.NET .

, .

<customErrors mode="On" defaultRedirect="YourErrorPage.htm" />

Answer 2

. , . , ValidateRequest = "true" EnableEventValidation = "true" web.config:

. ASP.NET.