Click here to Skip to main content
15,887,468 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
I am using HTML sanitizer to detect tag or script in input but I want to allow some characters in input like &, *. However, the sanitizer method replace the character & to & which is wrong

What I have tried:

public static bool IsDangerousString(string raw)
    {
        // Using HTML sanitizer nuget for more info https://github.com/mganss/HtmlSanitizer
        raw = abc&123;
        var sanitiser = new HtmlSanitizer();
        var sanitised = sanitiser.Sanitize(raw);
        return raw != sanitised; // should return false but returns true
    }
Posted
Comments
Richard Deeming 17-Mar-22 4:49am    
& on its own is not valid in an HTML context; it has to be encoded as &.

If you're allowing characters which are not valid in HTML, then you are not generating HTML. An HTML sanitiser is not the correct tool to process non-HTML content.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900