title: How to solve Reflected Cross-Site Scripting (XSS) Vulnerabilities in HTML/aspx site
body: <p>I have something like this:</p>
  
  <pre><code>&lt;td&gt;
       &lt;a href="pagina3.aspx?u=&lt;%=request.querystring.get("u")%&gt;&amp;t=2&amp;p=&lt;%=Request.QueryString.Get("p")%&gt;"&gt;
           &lt;img src="image.png" /&gt;
       &lt;/a&gt;
   &lt;/td&gt;
  </code></pre>
  
  <p>But this way I have an XSS vulnerability detected. There's a proper way to use querystring and avoid the vulnerability or I have to change the way I pass the parameter?
  I tried something like this:</p>
  
  <pre><code>    &lt;td&gt;
          &lt;form method="post" action="pagina3.aspx"&gt;
              &lt;input type="hidden" value="&lt;%=request.querystring.get("u")%&gt;" name="u" /&gt;
      &lt;input type="hidden" value="2" name="t" /&gt;
      &lt;input type="hidden" value="&lt;%=request.querystring.get("p")%&gt;" name="p" /&gt;
  &lt;input type="image" value="submit" src="image.png" alt="submit Button" /&gt;
          &lt;/form&gt;
       &lt;/td&gt;
  </code></pre>
  
  <p>But it's not working, because all the page is in a master page that already have a form.
  Any suggestion?</p>