I'm really confused about the best way to implement XSS protection on my ASP.Net-based site (I'm using .Net 4.5). My understanding was that at some point Microsoft had a library called AntiXSS, but, looking at the comments on it, it appears to be abandoned,
and the last version was excoriated by the .Net community for being pretty much broken.
My problem is that I have a site where I want to allow users to input things like <b>, <p>, and <ul> tags so they can format their text a little. Which means I need to turn off the standard validation. But I also want to protect against possible XSS attacks.
I'm not using SQL, so I'm less concerned about SQL Injection attacks (which sometimes are entangled in threads about XSS).
Are there documented best practices or maintained code somewhere that'll help me to solve this problem?
Go to the complete details ...