I'm thinking of using strait HTML for a rich WYSIWYG text editor. (like with these forums). For security purposes what are the substrings to watch out for? (so that one can use .Replace() or Regex to filter the bad stuff)
I guess the main things is to watch out for SQL code and javascript. I'm looking for substrings like:
"<script"
or SQL code like:
"EXEC("
Obviously there is plenty to be watching out for. Do you all have a list of search strings that you feel confident in? Which is to say, what do you do when the aspx page when you set ValidateRequest="False"
If not, do you keep ValidateRequest="True" and work around it another way? What is the favored approach?
Go to the complete details ...