SYSK 77: The Difference Between Microsoft.Security.Application.AntiXSSLibrary.HtmlEncode and System.Web.HttpUtility.HtmlEncode

As many of you may know, on Feb. 26 Microsoft has released Microsoft Application Security Anti-Cross Site Scripting Library.  The download is available at


The question is, since we already have HtmlEncode method under System.Web.HttpUtility to combat XSS, why do we need anything else?  As it turns out, HttpUtility.HtmlEncode only escapes the known dangerous characters/strings; the new AntiXSSLibrary.HtmlEncode (and UrlEncode) only allows a small subset of known safe strings and escapes everything else.  This is a much safer way to go!


P.S. If you would like to better understand the dangers of Cross Site Scripting, read this great paper -- HTML Code Injection and Cross-site scripting (

Comments (3)

  1. David Coe says:

    Microsoft just released its first version of the Anti-Cross Site Scripting Library V1.0. 


  2. billys says:

    Hello! I am Billy Johnson Nice design. Enjoy! Good site! OK. 0n79p7k .

Skip to main content