Take Charge of Your Security

Today I read something where someone was comparing Web Forms to ASP.NET MVC and suggested that Web Forms does a lot more than ASP.NET MVC to protect your site from malicious attacks. One example cited was that Server controls automatically handled HTML encoding so you don?t have to really think about it. The idea here is that Web Forms automatically protects you from XSS attacks. My friends, I?m afraid this is just not true. Take a look at the following page code. <%@ Page Language="C#" Inherits="System.Web.UI.Page" %> <% //For demo purposes, we have inline code here. // Pretend the following userInput came from the database string userInput = "<script>alert('You?ve been Haacked!');</script>"...(read more) ...