1

This question already has an answer here:

I was reading about XSS, and I know that ASP.NET doesn't allow saving HTML to database.

So my question is Does using ASP.NET make my web application secure regarding XSS completely, without additional work from me, since attacker can't submit any malicious code?

I know there are other ways malicious attackers can try, but I'm just asking about XSS right now.

marked as duplicate by SilverlightFox, Community Oct 27 '15 at 14:27

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    Users will (hopefully) not be submitting requests directly to your SQL Server. There will be intermediary code that can have XSS vulnerabilities. SQL Server simply cannot prevent this possibility. – Scott Johnson Oct 17 '15 at 20:22
  • @ScottJohnson I think I'm missing something. Please let me ask you, if the user couldn't submit his script to database, then it won't affect other users, right? What intermediary code will do if it cannot be save anyway? Also it would be great if you can recommend further readings. – Ahmed Oct 17 '15 at 20:28
  • 1
    This has an example of a trivial XSS vulnerability without using a DB. Note that what they call "non-persistent" is more commonly called "reflected". Same meaning, just different vernacular. – Neil Smithline Oct 17 '15 at 20:50
  • 2
    How do you mean it doesn't allow saving HTML? It does - HTML is simply text. – SilverlightFox Oct 22 '15 at 16:08
  • 2
    Ahmed, you completely changed the question, so now the Answer makes no sense. I would ask a separate question because you have already accepted the Answer below. – schroeder Oct 26 '15 at 16:35
7

SQL Server does not prevent XSS. XSS would still be possible via issues in the web application code. Proper use of prepared statements with SQL Server can prevent SQLi, but to prevent XSS, you must validate data received from untrusted sources and encode data before returning it in an HTTP response.

Not the answer you're looking for? Browse other questions tagged or ask your own question.