Forgive the title of the post, it was hard coming up with something succinct that captured the purpose of the post. This was inspired by a recent experience with a client who had this exact problem with one of their production systems.
TL;DR
Never use Request.QueryString to access parameters in your views, even when you’re sure your actions have validated them. You may open your application up to XSS attacks. Always, always use data that is passed to your views via the Model or the ViewData dictionary. Under no circumstances should you trust data coming in from the web, that includes query string parameters.
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.