Should I use html.encode for queryString to prevent cross site scripting issue in c#?

Question

I have an ITS soap solution and I was wondering if I should use html.encode for the query string.

[ValidateInput(false)]
public ActionResult Sample()
{
    string testLogin = Request.QueryString["testLogin"];
    if (string.Equals(testLogin, "true"))
    {
        return View("TestLoginView");
    }
}

I have given the validateinput as false, does my page becomes more secure if I make it as true? In place of Request.QueryString["testLogin"] should I use html.encode(Request.QueryString["testLogin"]) to make it more secure?

Answer 1

You should only use Html.Encode when converting non-html data to html, i.e. encoding it as html. In your example, you're comparing a value against another value - not doing anything involving html; so no: you do not need to html-encode it. However, since you're comparing it to the literal "html" (which doesn't involve any escaped tokens), it also won't change the truthiness (or not) of that test - it is just unnecessary.

Typically you might use Html.Encode when rendering data in an html view, although it is usually easier to use the inbuilt encoding in modern razor.