Using classic ASP, is this the right way to do to protect against XSS?
var1=untrusteduserinput
Showing a text in the body
<%=server.htmlencode(var1)%>
Showing a link in the body
<a href="http://www.example.com/page.asp?var1=<%=server.urlencode(var1)%>"><%=server.htmlencode(var1)%></a>
Showing an image
<img src="http://www.example.com/images/<%=server.urlencode(var1)%>" alt="<%=server.htmlencode(var1)%>">
Showing an iframe
<iframe src="http://www.example.com/page.asp?var1=<%=server.urlencode(var1)%>"></iframe>
In meta tags
<meta name="description" content="<%=server.htmlencode(var1)%>">
In forms
<input type="text" name="var1" value="<%=server.htmlencode(var1)%>">
EDIT: In e-mail
<a href="mailto:<%=server.urlencode(var1)%>">Email</a>
EDIT 2:
Why does http://
become %3A%2F%2F
when using urlencode on a link like this? Then the link doesn't work.
<a href=”<%=server.urlencode(var1)%>”><%=server.htmlencode(var1)%></a>
EDIT 3:
Thank you so much for your replies! However, I am not sure if I understand this right. XSS is dangerous on output, on what is printed on the website so that others can see it, right? So I thought that is was the fact that the link appears as a clickable link that made it more dangerous? That someone inject malicious code that´s executed when someone clicks on the link? And that it was because of that I had to use urlencode instead of htmlencode.
If I have a link that someone else entered in a form, how can it be safe with only HTMLencode? I do not know if it´s a link within my own website or if it´s to an external website. In theory, it can look exactly like the link in my first example where I used urlencode of a variable that was only a part of the link.
I read in this forum https://stackoverflow.com/questions/205923/best-way-to-handle-security-and-avoid-xss-with-user-entered-urls about someone who has similar issue and from that post I thought it's very dangerous and nearly impossible to protect agains XSS displaying an external url?
I also spent hours Googling for a classic asp regexp that is able to verify that it is an external link without dangerous content but could not find anything.