title: Is it enough to use HTMLEncode to display uploaded text?
body: <p>We're allowing users to upload pictures and provide a text description. Users can view this through a pop up box (actually a div ) via javascript. The uploaded text is a parameter to a javascript function. I 'm worried about XSS and also finding issues with HTMLEncode(). <br>
  We're using HTMLEncode to guard against XSS. Unfortunately, we're finding that HTMLEncode() only replaces '&lt;' and '>'. We also need to replace single and double quotes that people may include. Is there a single function that will do all these special type characters or must we do that manually via .NET string.Replace()?</p>