C＃：使用XmlTextWriter消毒XML文本值？

Question

I'm using XmlTextWriter to serialize and persist some of my data. Several of the fields I serialize are based on user input (eg Username). Today I use the WriteElementString method of XmlTextWriter .

My question is: the second parameter of WriteElementString is the text value to be written. How can I sanitize it prior to writing?

An example code:

XmlTextWriter writer = new XmlTextWriter("filename.xml", null);

writer.WriteStartElement("User");
writer.WriteElementString("Username", inputUserName);
writer.WriteElementString("Email", inputEmail);
writer.WriteEndElement();

writer.Close();

The variables inputUserName and inputEmail are user-input, and I would like to sanitize/escape them prior to writing.

What's the best way to achieve this?

Answer 1

What exactly do you need to escape there? WriteElementString will do all escaping needed by XML already (ie & -> & , < -> < , etc)

Answer 2

You could safe these Values as CDATA that will be safest you can do with xml.

Prior you should check the values via RegEx or any other validation.