System.Web.Security.AntiXss.AntiXssEncoder vs Microsoft.Security.Application.AntiXssEncoder

asp.net asp.net-4.5 antixsslibrary
Alexander Simonov picture Alexander Simonov · Aug 12, 2013 · Viewed 17.4k times · Source

In ASP.NET 4.5 there is a new namespace System.Web.Security.AntiXss which includes encoding routines from version 4.0 of the AntiXssLibrary (http://www.asp.net/aspnet/overview/aspnet-45/whats-new#_Toc318097382).

The latest version of AntiXssLibrary is 4.2.1.

I'm quite confused what type I should use for encoding output HTML in my new project: built in System.Web.Security.AntiXss.AntiXssEncoder or Microsoft.Security.Application.AntiXssEncoder from AntiXssLibrary. Could anyone tell me what type is preferred to use and why?

Answer

Levi picture Levi · Aug 12, 2013

The one in the System.Web.* namespace is a clone of the one in the Microsoft.Security.* namespace, but the System.Web one is slightly tweaked for better performance characteristics. We recommend the System.Web one going forward.

If you set the <httpRuntime encoderType> setting as described at http://www.asp.net/aspnet/overview/aspnet-45/whats-new#_Toc318097382, then you can just use the built-in encoding routines like HttpUtility.HtmlEncode, and the implementation will be provided by the Anti-XSS libraries.

Related questions

Failed to load viewstate. The control tree into which viewstate is being loaded

I am receiving the following error message after an HTTP POST on an ASP.NET form hosted inside a UserControl: Failed to load viewstate. The control tree into which viewstate is being loaded must match the control tree that was …

Read More
User.Identity.IsAuthenticated is false after successful login

I need to get the UserId Guid directly after a successful login. The following code doesn't work: if (Membership.ValidateUser(txtUsername.Value, txtPassword.Value)) { FormsAuthentication.SignOut(); FormsAuthentication.SetAuthCookie(txtUsername.Value, true); if (HttpContext.Current.User.Identity.IsAuthenticated) { // doesn't run Guid …

Read More
Build ASP.NET 4.5 without Visual Studio on Build Server

Its been a while since I setup a Build Server so maybe I've forgotten something or maybe .NET 4.5 is different from whatever version I did this with last time, but here is my problem. I'm trying to setup a build …

Read More