I have a web application that I work on. We have to use HP Fortify to validate everything. A lot of the text fields or labels are being flagged. I need to allow some specific characters through with taking the risk at hand. What is the best way to handle
this issue? Basically Fortify is telling me I need to html encode it, but then it could display an apostrophe as the asci characters instead of '.
Is it okay to do a "white list" of the html characters we can accept?
I am also using Entity Framework. It automatically prevents SQL injection in a sense of an apostrophe being passed in etc - correct?
Go to the complete details ...