输入时，输入HTML标签，读出来绑定GridView时，把格式都变了

[sunchf]

我的项目中有一个注册的部分，用户名随便，现在如果输入了一个html标签，如：<td>a</td>,从数据库读出并绑定到GridView上，结果格式都变了，多出了一列，请高手解决。

[满衣兄]

把非法字符过滤掉

[ufo20020427]

进行编码
<asp:GridView ID="GridView1" runat="server" AutoGenerateColumns="False">
<Columns>
<asp:TemplateField HeaderText="name">

<asp:Label ID="Label1" runat="server" Text='<%# Eval("Name") %>' ></asp:Label>
<%# Eval("Name","HtmlEncode{0}" )%>
</asp:TemplateField>
</Columns>
</asp:GridView>

[ufo20020427]

<asp:GridView ID="GridView1" runat="server" AutoGenerateColumns="False">
<Columns>
<asp:TemplateField HeaderText="name">

<asp:Label ID="Label1" runat="server" Text=<%# Eval("Name","HtmlEncode{0}" )%> ></asp:Label>

</asp:TemplateField>
</Columns>
</asp:GridView>

[cyz9977]

給你兩段代碼，原理自己去琢磨

//將html轉為text
        public string HtmlToText(string strContent)
        {
            strContent = strContent.Replace("&", "&");
            strContent = strContent.Replace("''", "'");
            strContent = strContent.Replace("<", "<");
            strContent = strContent.Replace(">", ">");
            strContent = strContent.Replace("<", "chr(60)");
            strContent = strContent.Replace(">", "chr(37)");
            strContent = strContent.Replace(""", "\"");
            strContent = strContent.Replace(";", ";");
            strContent = strContent.Replace("<br />", "\n");
            strContent = strContent.Replace(" ", " ");
            return strContent;
        }

        //將text轉為html
        public string TextToHtml(string strContent)
        {
            strContent = strContent.Replace("&", "&");
            strContent = strContent.Replace("'", "''");
            strContent = strContent.Replace("<", "<");
            strContent = strContent.Replace(">", ">");
            strContent = strContent.Replace("chr(60)", "<");
            strContent = strContent.Replace("chr(37)", ">");
            strContent = strContent.Replace("\"", """);
            strContent = strContent.Replace(";", ";");
            strContent = strContent.Replace("\n", "<br/>");
            strContent = strContent.Replace(" ", " ");
            return strContent;

        }

[yhf831011]

void submitBtn_Click(object sender, EventArgs e)
...{
// 将输入字符串编码，这样所有的HTML标签都失效了。
StringBuilder sb = new StringBuilder(
HttpUtility.HtmlEncode(htmlInputTxt.Text));
// 然后我们选择性的允许 <b> 和 <i>
sb.Replace("<b>", " <b>");
sb.Replace("</b>", "");
sb.Replace("<i>", " <i>");
sb.Replace("</i>", "");
Response.Write(sb.ToString());
}

[ufo20020427]

Response.Write(Server.HtmlEncode("<script>alert('ok')</script>"));

你试下把Server.HtmlEncode去掉与不去就明白了

[Lakers_24号程序员]

LZ,我无语

[sunchf]

[Quote=引用 7 楼 sammy_luo 的回复:]
LZ,我无语
[/Quote]
为什么？？