javascriptasp.netsql-serversecuritydatabase-security

What HTML tags would be considered dangerous if stored in SQL Server?

Considering issues like CSRF, XSS, SQL Injection...

Site: ASP.net, SQL Server 2012

I'm reading a somewhat old page from MS: https://msdn.microsoft.com/en-us/library/ff649310.aspx#paght000004_step4

If I have a parametrized query, and one of my fields is for holding HTML, would a simple replace on certain tags do the trick?

For example, a user can type into a WYSIWYG textarea, make certain things bold, or create bullets, etc.

I want to be able to display the results from a SELECT query, so even if I HTMLEncoded it, it'll have to be HTMLDecoded.

What about a UDF that cycles through a list of scenarios? I'm curious as to the best way to deal with the seemingly sneaky ones mentioned on that page:

Quote:

An attacker can use HTML attributes such as src, lowsrc, style, and href in conjunction with the preceding tags to inject cross-site scripting. For example, the src attribute of the tag can be a source of injection, as shown in the following examples.

<img src="javascript:alert('hello');">
<img src="java&#010;script:alert('hello');">
<img src="java&#X0A;script:alert('hello');">

An attacker can also use the <style> tag to inject a script by changing the MIME type as shown in the following.

<style TYPE="text/javascript">
  alert('hello');
</style>

So ultimately two questions:

  1. Best way to deal with this from within the INSERT statement itself.
  2. Best way to deal with this from code-behind.
Solution
    1. Best way to deal with this from within the INSERT statement itself.

    None. That's not where you should do it.

    1. Best way to deal with this from code-behind.

    Use a white-list, not a black-list. HTML encode everything, then decode specific tags that are allowed.

    It's reasonable to be able to specify some tags that can be used safely, but it's not reasonable to be able to catch every possible exploit.