title: What is the best way to filter bad HTML Content from Posts using AntiXSS Library?
body: <p>I want to create an Asp.net Website and I want to prevent Cross Site Scripting. I have a page with Summernote (a WYSIWYG HTML Editor), which, when submittet, posts HTML Code to MVC ActionResult via form or Ajax Post.
  This Method saves this Code in my Database as content/body of a message. On another Site, you can display the content, which shows formating things like Lists etc.</p>
  
  <p>Because of security reasons i want to filter the content i recieve from client. I am using the AntiXSS Library from Microsoft.</p>
  
  <p>A part of my MVC Code:</p>
  
  <pre><code>[ValidateInput(false), HttpPost, ValidateAntiForgeryToken]
  public ActionResult CreateMessage(string subject, string body)
  {
      var cleanBody = Sanitizer.GetSafeHtmlFragment(body);
      //do the Database thing here
  }
  </code></pre>
  
  <p>The major problem is, that it kills my HTML Elements with  tag, because it removes the src=""</p>
  
  <p>should be:</p>
  
  <pre><code>&lt;p&gt;&lt;img src="data:image/png;base64,some/ultra/long/picture/code/here" data-filename="grafik.png"&gt;&lt;/p&gt;
  </code></pre>
  
  <p>remaining:</p>
  
  <pre><code>&lt;p&gt;&lt;img src="" alt=""&gt;&lt;img src=""&gt;&lt;/p&gt;
  </code></pre>
  
  <p>What can i do to prevent this?
  Is there a way to add an exception rule?
  Is there an another better way?
  How does it work? </p>
  
  <p>Thanks for help!</p>