KB: Anti-XSS 3.0 Security Runtime Engine causing blank TemplateField columns in ASP.NET GridView


Problem: When using Anti-XSS 3.0 Beta Security Runtime Engine (i.e. the http module), data binding <%#Eval(xxx)%> in TemplateField column of ASP.NET GridView becomes blank. However, BoundField column is not affected.


image becomes


Resolution: Exclude the page / GridView from the Anti-XSS SRE, and use Anti-XSS Library encode methods in the data binding expression.

Example: <%#Microsoft.Security.Application.AntiXss.HtmlAttributeEncode((string)Eval(xxx))%>


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s