<p>PHP has a great function called <a href="http://us2.php.net/manual/en/function.htmlspecialchars.php" rel="noreferrer">htmlspecialcharacters()</a> where you pass it a string and it replaces all of HTML's special characters with their safe equivalents, it's <em>almost</em> a one stop shop for sanitizing input. Very nice right?</p>

<p>Well is there an equivalent in any of the .NET libraries?</p>

<p>If not, can anyone link to any code samples or libraries that do this well?</p>

[{'answer_id': 16801, 'author': 'Forgotten Semicolon', 'author_id': 1960, 'author_profile': 'https://Stackoverflow.com/users/1960', 'pm_score': 3, 'selected': False, 'text': '<p><a href="https://msdn.microsoft.com/en-us/library/system.web.httputility.htmlencode(v=vs.110).aspx" rel="nofollow noreferrer">System.Web.HttpUtility.HtmlEncode(string)</a></p>\n'}, {'answer_id': 16802, 'author': 'Nick Berardi', 'author_id': 17, 'author_profile': 'https://Stackoverflow.com/users/17', 'pm_score': 5, 'selected': True, 'text': '<p>Try this.</p>\n\n<pre><code>var encodedHtml = HttpContext.Current.Server.HtmlEncode(...);\n</code></pre>\n'}, {'answer_id': 16807, 'author': 'Jason Shoulders', 'author_id': 1953, 'author_profile': 'https://Stackoverflow.com/users/1953', 'pm_score': 2, 'selected': False, 'text': "<p>Don't know if there's an exact replacement, but there is a method <code>HtmlUtility.HtmlEncode</code> that replaces special characters with their HTML equivalents. A close cousin is <code>HtmlUtility.UrlEncode</code> for rendering URL's. You could also use validator controls like <code>RegularExpressionValidator</code>, <code>RangeValidator</code>, and <code>System.Text.RegularExpression.Regex</code> to make sure you're getting what you want.</p>\n"}, {'answer_id': 1261065, 'author': 'michalstanko', 'author_id': 154440, 'author_profile': 'https://Stackoverflow.com/users/154440', 'pm_score': 2, 'selected': False, 'text': '<p>Actually, you might want to try this method:</p>\n\n<pre><code>HttpUtility.HtmlAttributeEncode()\n</code></pre>\n\n<p>Why? Citing the <a href="http://msdn.microsoft.com/en-us/library/wdek0zbf.aspx" rel="nofollow noreferrer">HtmlAttributeEncode page at MSDN docs</a>:</p>\n\n<blockquote>\n  <p>The HtmlAttributeEncode method converts only quotation marks ("), ampersands (&amp;), and left angle brackets (&lt;) to equivalent character entities. It is considerably faster than the HtmlEncode method.</p>\n</blockquote>\n'}, {'answer_id': 29680929, 'author': 'Memet Olsen', 'author_id': 1017953, 'author_profile': 'https://Stackoverflow.com/users/1017953', 'pm_score': 1, 'selected': False, 'text': '<p>In an addition to the given answers:\nWhen using <a href="http://en.wikipedia.org/wiki/ASP.NET_Razor_view_engine" rel="nofollow">Razor view engine</a> (which is the default view engine in ASP.NET), using the \'@\' character to display values will automatically encode the displayed value. This means that you don\'t have to use encoding.</p>\n\n<p>On the other hand, when you <strong>don\'t</strong> want the text being encoded, you have to specify that explicitly (by using <a href="https://msdn.microsoft.com/en-us/library/gg480740%28v=vs.118%29.aspx" rel="nofollow">@Html.Raw</a>). Which is, in my opinion, a good thing from a security point of view.</p>\n'}]
['https://Stackoverflow.com/questions/16795', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/1366/']