title: How to overcome stored cross site scripting vulnerability in Asp.net c#
body: <p>The part of the code am working on is vulnerable to stored XSS. Below is the code.</p>
  
  <pre><code>    &lt;asp:GridView ID="GridView1" runat="server" AutoGenerateColumns="False"     OnRowCancelingEdit="GridView1_RowCancelingEdit"    
              OnRowEditing="GridView1_RowEditing"  OnRowUpdating="GridView1_RowUpdating" OnRowDeleting="GridView1_OnRowDeleting"  OnPageIndexChanging="GridView1_PageIndexChanging"  Width ="1000px" class="grid"&gt;
  
  
         &lt;Columns&gt;   
  
              &lt;asp:TemplateField HeaderText="User Name"&gt;   
                  &lt;ItemTemplate&gt;   
                      &lt;asp:Label ID="lbl_Name" runat="server" Text='&lt;%#Eval("Uname") %&gt;'&gt;&lt;/asp:Label&gt;   
                  &lt;/ItemTemplate&gt;   
                  &lt;EditItemTemplate&gt;   
                      &lt;asp:TextBox ID="txt_Name" runat="server" Text='&lt;%#Eval("Uname") %&gt;'&gt;&lt;/asp:TextBox&gt;   //this is the line vulnerable to XSS
                  &lt;/EditItemTemplate&gt;   
              &lt;/asp:TemplateField&gt;       &lt;/columns&gt;
  &lt;/asp:GridView&gt;  
  </code></pre>
  
  <p>code behind</p>
  
  <pre><code>  DataTable dt = new DataTable();
          try
          {
              SqlConnection con = new SqlConnection(conn);
              con.Open();
              SqlDataAdapter adapt = new SqlDataAdapter("Select Uid,Uname,Utype,Uemail,ClientName,ProjectName,Ulog from usrtable where ClientName='" + clientname + "' and Utype='Admin' or ClientName='" + clientname + "'and Utype='Normal'", con);
              **adapt.Fill(dt);**//this is again vulnerable
              con.Close();
          }  
  
   if (dt.Rows.Count &gt; 0)
                  {
                      GridView1.DataSource = dt;
                      GridView1.DataBind();
                  }
  </code></pre>
  
  <p>Am not familiar with XSS. I went through lot of documents. It asks us to encode the data. But in my case how do I proceed.i have many labels and textboxes as item templates in GV. using this to update the table rows.</p>