XSS mitigation in HTML/VBScript/Classic ASP

Question

I'm faced with the following hypothetical XSS vulnerability in my web code:

original code: <INPUT TYPE=HIDDEN NAME='acctno' VALUE='" &Session("acctno")& "'>

hacked code: <INPUT TYPE=HIDDEN NAME='acctno' VALUE='12345'/><script>alert(98765)</script>

Can I mitigate this simply by adding HTMLEncode to the session variable in the value field?
Thanks.

Answer 1

Exactly. You need to HTML encode all text that gets inserted into the HTML.

You also need to Javascript-encode any text that gets inserted into Javascript code, and you need to URL-encode any text that gets inserted into URLs.