asp.net - 我应该只在“丰富的 html 值”上使用 html sanitizer 吗？

Question

我是否需要清理传递给我的控制器的所有字符串值或只是像编辑器这样的富 html？

那么 input ， type 文本字段呢？

<input type="text" name"test1" value="<script></script>" />


public ActionResult TestAction(string test1){ //save in db }

Answer 1

Always sanitize data being sent to the server. You don't want anyone to arbitrarily send data to your server of any type. Some HTML tags, such as <script> elements, can be harmful. You don't want the user storing JavaScript code in your content pages as it could be malicious for other users.