title: Stopping XSS when using WebAPI
body: <p>I have a controller which accepts</p>
  
  <pre><code>public class MyModel
  {
     [MaxLength(400)]
     public string Message { get; set; }
  }
  </code></pre>
  
  <p>I have a WebApi Post Action</p>
  
  <pre><code>public HttpResponseMessage Post(MyModel viewModel)
  {
              if (!ModelState.IsValid)
                  return new HttpResponseMessage(HttpStatusCode.BadRequest);                 
              ...
  }
  </code></pre>
  
  <p>And a get action. </p>
  
  <p>Since the content is written out by javascript rather than directly in a view the exact content was getting written out, also no asp.net warnings about dangerous content kicked in.</p>
  
  <p>I want to protect against XSS. At the moment I am doing</p>
  
  <pre><code>HttpUtility.HtmlEncode(Regex.Replace(p.Message, @"&lt;[^&gt;]*&gt;", String.Empty))
  </code></pre>
  
  <p>in the Get action. (Taken some code from <a href="https://stackoverflow.com/questions/787932/using-c-sharp-regular-expressions-to-remove-html-tags">Using C# regular expressions to remove HTML tags</a>)</p>
  
  <p>Is there any protection built in to Asp.Net I should be using?  Are there any attributes I can decorate my model with? </p>
  
  <p>I noticed this <a href="http://stephenwalther.com/archive/2012/06/25/announcing-the-june-2012-release-of-the-ajax-control-toolkit.aspx" rel="noreferrer">http://stephenwalther.com/archive/2012/06/25/announcing-the-june-2012-release-of-the-ajax-control-toolkit.aspx</a> but clicking through to <a href="http://wpl.codeplex.com/" rel="noreferrer">http://wpl.codeplex.com/</a> is seems to be very badly reviewed. </p>