Click here to Skip to main content
15,902,887 members
Home / Discussions / C#
   

C#

 
GeneralRe: adding item to listbox Pin
netJP12L29-Sep-08 5:09
netJP12L29-Sep-08 5:09 
GeneralRe: adding item to listbox Pin
cpkilekofp29-Sep-08 6:46
cpkilekofp29-Sep-08 6:46 
GeneralRe: adding item to listbox Pin
netJP12L29-Sep-08 9:34
netJP12L29-Sep-08 9:34 
GeneralRe: adding item to listbox Pin
cpkilekofp29-Sep-08 11:34
cpkilekofp29-Sep-08 11:34 
GeneralRe: adding item to listbox Pin
cpkilekofp29-Sep-08 4:32
cpkilekofp29-Sep-08 4:32 
GeneralRe: adding item to listbox Pin
netJP12L29-Sep-08 4:57
netJP12L29-Sep-08 4:57 
Questionreg expression Pin
nesfrank22-Sep-08 6:23
nesfrank22-Sep-08 6:23 
AnswerRe: reg expression Pin
Daniel Grunwald22-Sep-08 6:54
Daniel Grunwald22-Sep-08 6:54 
A regex just searches for a pattern. Assuming the strip regex below is used to replace html tags with the empty string, you cannot use it to replace anything with a space.
You can combine two patterns like this:
str = Regex.Replace(str, @"( |\s)+", " ");

Also, your GetRegExpStripHTML doesn't work. It strips only a few well-formed known tags - that's not enough to prevent cross-site scripting exploits.
What about <SCRIPT> or < SCRIPT> ?
What about tags you forgot, like <BODY onload="...">?
What about encoding the characters using some far-east codepage that your app doesn't understand? The codepage auto-detection of the browser might detect the codepage and execute the scripts.
What about null bytes like <SCR\0IPT>? Your regex won't see the script tag, but Internet Explorer still does.
What about any of a huge number of other tricks to evade XSS filters?

You need to encode any < > &, a blacklist won't get you anywhere as browsers have lots of ways to execute code that you never heard about. And even that isn't 100% safe when playing with the charset tricks.
See http://ha.ckers.org/xss.html[^] to get an idea about what kind of attacks on XSS filters are possible.
GeneralRe: reg expression Pin
nesfrank22-Sep-08 7:50
nesfrank22-Sep-08 7:50 
GeneralRe: reg expression Pin
Daniel Grunwald22-Sep-08 7:54
Daniel Grunwald22-Sep-08 7:54 
QuestionShowDialog method not showing the popup in foreground. Pin
PrashantGadhave22-Sep-08 4:45
PrashantGadhave22-Sep-08 4:45 
AnswerRe: ShowDialog method not showing the popup in foreground. Pin
Thomas Stockwell22-Sep-08 6:03
professionalThomas Stockwell22-Sep-08 6:03 
AnswerRe: ShowDialog method not showing the popup in foreground. Pin
Paul Conrad22-Sep-08 6:36
professionalPaul Conrad22-Sep-08 6:36 
GeneralRe: ShowDialog method not showing the popup in foreground. Pin
PrashantGadhave22-Sep-08 6:54
PrashantGadhave22-Sep-08 6:54 
Questionwork with a ssh connection Pin
caradri22-Sep-08 4:45
caradri22-Sep-08 4:45 
AnswerRe: work with a ssh connection Pin
Paul Conrad22-Sep-08 6:35
professionalPaul Conrad22-Sep-08 6:35 
RantRe: work with a ssh connection Pin
caradri22-Sep-08 18:51
caradri22-Sep-08 18:51 
QuestionHow do I set the location of a form? Pin
arnold_w22-Sep-08 4:06
arnold_w22-Sep-08 4:06 
AnswerRe: How do I set the location of a form? Pin
Caio Kinzel Filho22-Sep-08 4:17
Caio Kinzel Filho22-Sep-08 4:17 
AnswerRe: How do I set the location of a form? Pin
DaveyM6922-Sep-08 4:28
professionalDaveyM6922-Sep-08 4:28 
AnswerRe: How do I set the location of a form? Pin
Nouman Bhatti22-Sep-08 7:44
Nouman Bhatti22-Sep-08 7:44 
AnswerRe: How do I set the location of a form? Pin
arnold_w22-Sep-08 21:35
arnold_w22-Sep-08 21:35 
QuestionManagementObject Pin
arkiboys22-Sep-08 3:55
arkiboys22-Sep-08 3:55 
AnswerRe: ManagementObject Pin
Mark Salsbery22-Sep-08 6:35
Mark Salsbery22-Sep-08 6:35 
GeneralRe: ManagementObject Pin
arkiboys22-Sep-08 21:09
arkiboys22-Sep-08 21:09 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.