I use AntiXSS but I still can hack page
问题 I don't know if I am doing this right. I first time build something to prevent attack on page. I will start from the bottom: I have property: public string Description {get;set;} User can set it's value through tinyMCE tinyMCE.init({ mode: "textareas", theme: "advanced", encoding : "xml"... In controller before I save this in database I do: model.Description = HttpUtility.HtmlDecode(model.Description); In database I have a value like: <p>bla bla bla</p> I added AntiXSS library to my project: