简体繁体 English

C＃中的HtmlEncode

[英]HtmlEncode in C#

原文 2009-10-27 15:57:59 6 4 c#

Is there any way to html encode some text without using System.Web.HttpUtility.HtmlEncode method? 有没有办法在不使用System.Web.HttpUtility.HtmlEncode方法的情况下对某些文本进行html编码？ I want to deploy my desktop application using .NET 3.5 Client Profile and the problem is that System.Web.dll it's not part of the .NET 3.5 Client Profile so I have to find an workaround. 我想使用.NET 3.5 Client Profile部署我的桌面应用程序，问题是System.Web.dll它不是.NET 3.5 Client Profile的一部分，因此我必须找到一种解决方法。

4 个解决方案

I'm a fan of the AntiXSS library as well, but its worth mentioning that .net v4 includes a new utility class for encoding in System.dll. 我也是AntiXSS库的粉丝，但值得一提的是.net v4包含一个用于System.dll编码的新实用程序类。 So if you have the option of moving to .net v4, you can use the client profile. 因此，如果您可以选择转移到.net v4，则可以使用客户端配置文件。

System.Net.WebUtility.HtmlEncode System.Net.WebUtility.HtmlEncode

Rick Strahl rolled his own encoding method, due to problems and inconsistencies with .NET's way of encoding things. 由于.NET的编码方式存在问题和不一致，Rick Strahl推出了自己的编码方法。 Check out his post on Html and Uri String Encoding without System.Web . 在没有System.Web的情况下查看关于Html和Uri字符串编码的帖子。

UPDATE: After checking out the links provided by the other answers, the AntiXSS library provided by Microsoft seems like an ideal solution to this problem. 更新：在检查其他答案提供的链接后，Microsoft提供的AntiXSS库似乎是解决此问题的理想方法。 They've made the source of AntiXSS 4.3 available on Codeplex: http://antixss.codeplex.com/ 他们在Codeplex上提供了AntiXSS 4.3的源代码： http ： //antixss.codeplex.com/

The AntiXSS Library includes helpful methods for encoding HTML, URLs, JavaScript, and XML. AntiXSS库包含用于编码HTML，URL，JavaScript和XML的有用方法。 It's based on a secure whitelist model, so anything not allowed in the specifications is prohibited. 它基于安全的白名单模型，因此禁止在规范中允许的任何内容。

Note that according to the release notes for 4.3, June 2014, this is the last release that will contain a sanitizer, due to the negative feedback it got from the user community for being overly aggressive. 请注意，根据2014年6月的4.3发行说明，这是包含清洁剂的最后一个版本，因为它过于激进而从用户社区获得了负面反馈。 So if it's a sanitizer you want, you should look at AntiSamy or building your own with the HTML agility pack . 因此，如果它是您想要的消毒剂，您应该查看AntiSamy或使用HTML敏捷包构建您自己的消毒剂。

Can you include this ? 你能包括这个吗？ It has an alternative Encode method. 它有一个替代的Encode方法。

You could look at AntiXSS . 你可以看一下AntiXSS 。 It has it's own encoding mechanisms and is meant to be a replacement for the framework's HtmlEncode. 它有自己的编码机制，可以替代框架的HtmlEncode。