Question 1: I have a contact form with textboxes that users fill out, and when they click send two things happen: The code-behind sends me an email, and they are redirected to a confirmation page with a generic "thanks for sending us an email you will hear from us" message. None of their input is displayed on the confirmation page. The only time their own input is displayed is due to RequiredFieldValidation controls on the form itself, where for example, if one textbox is not filled, they get the message that they must fill in that textbox, and on that screen the data they have already entered in the other textboxes shows. Is this scenario safe from scripting / injection?
Question 2: Relative particularly to the CreateUserWizardL If I add a textbox to the Wizard, do I need to do anything special such as html encoding that textbox input or does the Wizard have scripting / injection protection built in?
Thanks for any insight ...
Go to the complete details ...