title: Bypassing query string validation (XSS prevention) in ASP.NET
body: <p>I was performing a security assessment on a very old project that I'm assigned to, which uses ASP.NET WebForms. Basically, there were plenty of "Back" buttons placed around the site, which would redirect the user back to the previous page (based on a Return Url value). </p>
  
  <p>The problem I found was that the button functionality was coded in JavaScript, with  tags around it, which meant that you could simply have something like ";alert('INSECURE!');" at the end of the return url and it would execute the script as soon as the button is clicked.</p>
  
  <p>In order to sanitize that, validation was added - whenever the request contains a single quote ('), a double quote(") or &lt;> symbols, an Invalid Request URL exception would be thrown. I'm fairly new to the security scene, so to me it sounds like a wonderful method.</p>
  
  <p>Unfortunately, as I said I am a beginner when it comes to XSS prevention. Has anyone done anything similar and know of vulnerabilities in this approach? (And yes, I did my research. Spent several hours looking into different material and techniques, could not find anything similar and not too outdated though).</p>
  
  <p>Thanks in advance!</p>