ASP.NET MVC Validation of Script Tags

Question

I want to prevent a user from entering any <script> tags inside a textarea box I have called story using very similar code to this:

if (ArticleToCreate.story.Contains("<script>") == true)
                ModelState.AddModelError("Story", "No script tags allowed!");

Unfortunately this won't work because it's looking for <script> exactly as it is rather than looking for <script>some code</script> or some code`

Can anyone help? I want to use very similar code to as shown above and not any Service Layers or Model scripts. Thanks

Answer 1

By default, MVC won't allow this. If you explicitly allow it (e.g., with [ValidateInput(false)]), then you need to use a tool like the Microsoft Web Protection Library to sanitize the input.