I'm looking at ways to use .NET to prevent XSS attacks and have come across the following methods to encode data:
string asdf = WebUtility.UrlEncode(code); string asdf1 = HttpUtility.UrlEncode(code); string asdf1a = HttpUtility.UrlEncodeUnicode(code); // OBSOLETE string asdf1b = HttpUtility.UrlPathEncode(code); string asdf1c = Uri.EscapeDataString(code); string asdf1d = Uri.EscapeUriString(code); string asdf1e = HttpUtility.HtmlEncode(code); string asdf1f = HttpUtility.HtmlAttributeEncode(code);
(I omitted the byte methods... but there are more)
Given that each one of these methods work in a completely different way, and are located in completely different classes I would assume it's easy to cause an XSS issue given the wrong mix of choices.
For a given situation, when is it appropriate to use a given encoding method? Why?