Ok I've discovered our web app will allow the user to rename a record to '); onclick=alert('This is an XSS vulernability. An attacker could do anything here (redirect to another website, virus etc)');('.txt which of course proceeds to be executed on the client whenever a user visits it.
I've attempted to sanitise the output (using HttpUtility.HtmlEncode) however this doesn't seem to do anything, so how on earth do I prevent the client seeing this as javascript?
...
Go to the complete details ...