title: How to handle XSS in a url query string in asp.net 3.5 using C#
body: <p>I'm current trying to secure my site from XSS attacks in the Url. For example if the attacker is using Firefox they can do the following  </p>
  
  <pre><code>myxsssite.com/mypage.aspx?d"&gt;&lt;script class="none&amp;&gt;alert(1);&lt;/script clas="none&amp;&gt;&lt;!--=1
  </code></pre>
  
  <p>And the script will be run. I've been searching around for a couple days now and can't seem to find a solution that works. Currently I've tried the AntiXSS library from MS. I don't think it's working correctly I'm encoding the whole url like so</p>
  
  <pre><code>Mircosoft.Security.Application.Encoder.HtmlEncode(path);
  </code></pre>
  
  <p>I've tried all the other methods in this class as well and the script is still being executed before the page loads. I'm using ASP.net 3.5 with Webforms, and I can't upgrade.</p>