2
\$\begingroup\$

I have a multiview to insert and edit users. Users are listed in a gridview. In selectedindexchanged event of gridview I've placed this code:

protected void GrvList_SelectedIndexChanged(object sender, EventArgs e)
{
    // EditView
    FrmaddEditUsers.ActiveViewIndex = 1;
    // Get Username
    UserName.Text = GrvList.DataKeys[GrvList.SelectedIndex].Value.ToString();
}

I wonder if it's necessary to change it as below, being afraid of values are changed by bad users:

protected void GrvList_SelectedIndexChanged(object sender, EventArgs e)
{
    // change to EditView
    FrmaddEditUsers.ActiveViewIndex = 1;
    // Get Username from gridview and display in txtbox
    string ToBeEditedUser = GrvList.DataKeys[GrvList.SelectedIndex].Value.ToString();
    UserName.Text = HttpUtility.HtmlEncode(ToBeEditedUser);
}
\$\endgroup\$
  • \$\begingroup\$ Depends upon whether you have the view state enabled or not and where you get the values of your list. \$\endgroup\$ – jmoreno May 29 '12 at 7:43
1
\$\begingroup\$

Since you are taking data from the user and passing it straight back, I would go with the encoded method. Also, on the serverside, since you are separating out the acquisition of the data from its reuse it should help with debugging.

\$\endgroup\$
1
\$\begingroup\$

It certainly wouldn't do any harm and if you users have a backend that does not do something like encode when the user's name goes into the database then this will prevent any nasties.

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.