You can protect your .Net web app by using [Razor HTML and Javascript encoding][1]
In addition to this there is a quite cool library:  [.NET AntiXSS Library][2] [which is][3]:

> an encoding library which uses a safe list approach to encoding. It
> provides Html, XML, Url, Form, LDAP, CSS, JScript and VBScript
> encoding methods to allow you to avoid Cross Site Scripting attacks.
> This library is part of the Microsoft SDL tools.


  [1]: https://docs.microsoft.com/en-us/aspnet/core/security/cross-site-scripting
  [2]: https://www.owasp.org/index.php/.NET_AntiXSS_Library
  [3]: https://www.nuget.org/packages/AntiXSS/