As we all know by now, XSS attacks are dangerous and really easy to pull off. Various frameworks make it easy to encode HTML, like ASP.NET MVC does:

<%= Html.Encode("string"); %>

But what happens when your client requires that they be able to upload their content directly from a Microsoft Word document?

Here's the scenario: People can copy and paste content from Microsoft word into a WYSIWYG editor (in this case tinyMCE), and then that information is posted to a web page.

The website is public, but only members of that organization will have access to post information to a webpage.

How do I handle these requirements in a secure fashion? Currently there is no checking done on what the client posts (since only 'trusted' users can post), but I'm not particularly happy with that and would like to lock it down further in case an account is hacked.

The only conceptual method that I'm aware of that meets these requirements is to whitelist HTML tags and let those pass through. Is there another way? If not, What is a secure way to let the user store input in the Database in any form, but only display it properly encoded and stripped of bad tags?

Related Question

Preventing Cross Site Scripting (XSS)

  • Nice question- here is a similar one though- stackoverflow.com/questions/445177/…
    – RichardOD
    Jun 18, 2009 at 19:52
  • Agreed. It is similar, but it is a confusing question (The question is hard to find), and it doesn't specifically ask if there's any other way. If there's another way to render HTML without having to Whitelist, I'm all about it. If there's a ASP.NET MVC View Engine that takes care of this, that's good to know too. Jun 18, 2009 at 19:57
  • On a non-security related note, filtering tags will probably be helpful from a user interface perspective. It is very easy to accidentally type an angle bracket and forget to escape it. Since we're talking about users who are copying from Word, it's a good idea to catch what looks like bad tags and encode them appropriately (i.e. &amp;lt;) so that things Just Work.
    – Conspicuous Compiler
    Jun 29, 2009 at 11:56
  • Regarding point #4: You bet it's still an issue! Most hacks are an inside job, after all. For a specific editor, I've had good luck using FreeTextBox but I can't speak to how well it matches up to your requirements, especially MVC. Jul 3, 2009 at 23:55
  • 1
    @gnat Thanks; edited. Looks like my question has gotten the attention of some sort of cabal; three downvotes in rapid succession, and your protection and edit request. Jan 26, 2015 at 15:33

5 Answers 5


The easiest way (for you as a developer) is probably to implement one of many variations of Markdown, for example Markdown.NET or, even better (imho), a wmd-editor.

Then, your users would be able to paste simple HTML, but nothing dangerous, and they would be able to preview their entered data and straighten out any scruples even before posting...

  • I believe StackOverflow use a custom editor without the need for WMD syntax
    – Jon
    Jun 22, 2009 at 11:15
  • 1
    StackOverflow does indeed use WMD. blog.stackoverflow.com/2008/05/… stackoverflow.com/questions/98852/…
    – Tomas Lycken
    Jun 22, 2009 at 12:29
  • What do you mean by WMD syntax? As far as I can tell, all WMD syntax works. And I haven't yet found anything that doesn't work...
    – Tomas Lycken
    Jun 24, 2009 at 8:55
  • 2
    The problem with using Markdown is that markdown allows arbitrary HTML; so by itself it is not a solution. Jan 26, 2015 at 13:20

Whitelisting is indeed the best way to prevent XSS attacks when allowing users to enter HTML, either directly or using a Rich Text Editor.

About your other questions:

Is there a WYSIWYG editor that includes the ability to whitelist on the fly?

I don't think this could work. You need server side code for this and the RTE runs on the client.

TinyMCE filters tags if you want but since this takes place in the browser you can't trust it. See extended_valid_elements. TinyMCE (Moxie) also suggests whitelisting, see here.

Should I even worry about this since it will only be for 'private posting'

You should always filter HTML unless there are specific reasons not to (very rare). Some reasons: a) functionality that is for internal users today maybe for the public tomorrow b) unauthorized access will have less of an impact

is the best way to let them store it in the Database in any form, but only display it properly encoded and stripped of bad tags?

That is the way I prefer it. I don't like to change user input before inserting into the database for various reasons.


I am doing the same thing. I am using TinyMCE and allowing pasting from Word documents. Only certain people that maintain the site can do this via an admin area. This is secured by ASP.Net Membership. I'm simple doing the HTML.Encode when it gets sent out to the public site.

You could use the code below if you like before it gets put in the database but not sure what knock on affect it would give you. You may have to go with your whitelist.

 /// <summary>
    /// Strip HTML
    /// </summary>
    /// <param name="str"></param>
    /// <returns></returns>
    public static string StripHTML(string str)
        //Strips the HTML tags from strHTML 
        System.Text.RegularExpressions.Regex objRegExp = new System.Text.RegularExpressions.Regex("<(.|\n)+?>");

        // Replace all tags with a space, otherwise words either side 
        // of a tag might be concatenated 
        string strOutput = objRegExp.Replace(str, " ");

        // Replace all < and > with < and > 
        strOutput = strOutput.Replace("<", "<");
        strOutput = strOutput.Replace(">", ">");

        return strOutput;
  • If they store text such as <script>alert("hey")</script> and you do Html.Encode(<script>alert("hey")</script>) it will just print that to page not run the alert
    – Jon
    Jun 18, 2009 at 20:27
  • I'm not using a whitelist, I am just storing it as is. The above function could help but I dont know what knock on affect it will have. Would like to know what you decide. Why is my post marked as negative?
    – Jon
    Jun 19, 2009 at 8:46
  • 1
    I would guess that's because the way your software is doing it is a very naive implementation; there are all sorts of tricks that will get around your implementation. Jun 19, 2009 at 16:12
  • 4
    A whitelist is a good idea, but your method certainly is not. Regex is not a reliable way to detect tags in text, as HTML can get pretty obfuscated. Much better to use a library such as the HTML Agility Pack.
    – Noldorin
    Jul 4, 2009 at 0:02

My IMHO keep trusting your users until you will go public.

Well, there is no reliable way to achieve your needs. For example any WYSIWYG editor fail to protect form inserting images with URLs (indirect usage track, illegal content) or text (illegal text, misspelled text, missized text).

My point of view is that if you can trust your users, simply allow everything, just warn users if there are KNOW dangerous markup (to keep them from errors).

If you do not trust, use sort of special markup (e.g. Markdown).

In my project we use special types for potentially dangerous content and special methods for rendering and accepting such content. This code has high mark in our thread model and attention to it is very high (for example each change should be reviewed by two independent coders, we have comprehensive test suite and so on).


One option might be the HTML Edit Control for .NET (which I wrote).

It's a WYSIWYM HTML editor for .NET, which only supports a subset of the HTML elements, excluding <script> elements: so in that way it acts as a whitelist.

If it's for internal use (i.e. an intranet site), then the control can be embedded in a web page.

I haven't integrated support for pasting from Word, but I do have a component which is a step in that direction: a Doc to HTML converter; so I have the building blocks which you could use in ASP.NET to convert a Doc to HTML, display the HTML in the editor, etc.

Not the answer you're looking for? Browse other questions tagged or ask your own question.