asp.net-mvc 如何将 HTML 保存到数据库并正确检索
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/21662766/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
How to save HTML to database and retrieve it properly
提问by 1110
Learning security these days :)
I need to allow users to enter text in a form and allow them some HTML tags: bold, italic, list etc. and to prevent them to add some dangerous JavaScript code.
So I have used this whitelist implementationto sanitize HTML.
But I am still confused about how to save and display it in the right way.
So here what I did:
Model:
最近在学习安全性 :)
我需要允许用户在表单中输入文本并允许他们使用一些 HTML 标签：粗体、斜体、列表等，并防止他们添加一些危险的 JavaScript 代码。
所以我使用这个白名单实现来清理 HTML。
但是我仍然对如何以正确的方式保存和显示它感到困惑。
所以在这里我做了什么：
模型：
public class Post
{
[AllowHtml]
public string Data { get; set; }
}
Controller:
控制器：
[HttpPost, ActionName("Create")]
[ValidateAntiForgeryToken]
public ActionResult Create(Post model)
{
// Decode model.Data as it is Encoded after post
string decodedString = HttpUtility.HtmlDecode(model.Data);
// Clean HTML
string sanitizedHtmlText = HtmlUtility.SanitizeHtml(decodedString);
string encoded = HttpUtility.HtmlEncode(sanitizedHtmlText);
View:
看法：
@using (Html.BeginForm("Create", "Home", FormMethod.Post)) {
@Html.AntiForgeryToken()
@Html.TextAreaFor(a=>a.Data)
<input type="submit" value="submit" />
}
So when I post a form I see:
因此，当我发布表单时，我看到：
<p>Simple <em><strong>whitelist</strong> </em>test:</p>
<ul>
<li>t1</li>
<li>t2</li>
</ul>
<p>Image:</p>
<p><img src="http://metro-portal.hr/img/repository/2010/06/medium/hijena_shutter.jpg" /></p>
Becaouse of <p><I think that I need to decode it first:
因为<p><我认为我需要先解码它：
<p>Simple <em><strong>whitelist</strong> </em>test:</p>
<ul>
<li>t1</li>
<li>t2</li>
</ul>
<p>Image:</p>
<p><img src="http://metro-portal.hr/img/repository/2010/06/medium/hijena_shutter.jpg" /></p>
Then I sanitize it against whitelist and I get sanitized HTML:
然后我根据白名单对其进行消毒，并获得经过消毒的 HTML：
<p>Simple <em><strong>whitelist</strong> </em>test:</p>
<ul>
<li>t1</li>
<li>t2</li>
</ul>
<p>Image:</p>
<p>
1) Should I save it like this in database?
2) Or I need to Encode this result and then save it to database (encoded bellow)?
1）我应该像这样将它保存在数据库中吗？
2）或者我需要编码这个结果然后将它保存到数据库（编码波纹管）？
<p>Simple <em><strong>whitelist</strong> </em>test:</p>
<ul>
<li>t1</li>
<li>t2</li>
</ul>
<p>Image:</p>
<p>
Here I am confused if I put it on the view like this:
如果我把它放在这样的视图上，我会感到困惑：
@Model.Data
I get this on the view:
我在视图中得到了这个：
<p>Simple <em><strong>whitelist</strong> </em>test:</p> <ul> <li>t1</li> <li>t2</li> </ul> <p>Image:</p> <p>
or
或者
<p>Simple <em><strong>whitelist</strong> </em>test:</p> <ul> <li>t1</li> <li>t2</li> </ul> <p>Image:</p> <p>
So what to do to display this HTML properly (bold, list etc.)?
那么如何正确显示此 HTML（粗体、列表等）？
回答by Darin Dimitrov
The rule of thumb is the following:
经验法则如下：
- Store in your database the RAW HTML without any encodings or sanitizings. A SQL server doesn't care if you store some string containing XSS code.
- When displaying this output to your page make sure that it is sanitized.
- 将 RAW HTML 存储在您的数据库中，无需任何编码或清理。SQL 服务器并不关心您是否存储了一些包含 XSS 代码的字符串。
- 将此输出显示到您的页面时，请确保对其进行了清理。
So:
所以：
[HttpPost, ActionName("Create")]
[ValidateAntiForgeryToken]
public ActionResult Create(Post model)
{
// store model.Data directly in your database without any cleaning or sanitizing
}
and then when displaying:
然后在显示时：
@Html.Raw(HtmlUtility.SanitizeHtml(Model.Data))
Notice how I used the Html.Raw helper here to ensure that you don't get double HTML encoded output. The HtmlUtility.SanitizeHtmlfunction should already take care of sanitizing the value and return a safe string that you could display in your view and it will not be further encoded. If on the other hand you used @HtmlUtility.SanitizeHtml(Model.Data), then the @razor function would HTML encode the result of the SanitizeHtmlfunction which might not be what you are looking for.
请注意我在这里如何使用 Html.Raw 帮助程序来确保您不会得到双重 HTML 编码的输出。该HtmlUtility.SanitizeHtml函数应该已经负责清理该值并返回一个安全字符串，您可以在您的视图中显示该字符串并且不会对其进行进一步编码。另一方面@HtmlUtility.SanitizeHtml(Model.Data)，如果您使用了，那么@razor 函数将对函数的结果进行 HTML 编码，SanitizeHtml这可能不是您要查找的结果。
回答by Alexander Barrios
To framework 4.5, Using MVC 5, use @Html.Raw(WebUtility.HtmlDecode(item.ADITIONAL_INFORMAtION))
对于框架 4.5，使用 MVC 5，使用 @Html.Raw(WebUtility.HtmlDecode(item.ADITIONAL_INFORMAtION))
回答by Amirhossein
You can save HTML file in database by datatype VARBINARY(MAX) for htmlcolumn .
您可以通过 htmlcolumn 的数据类型 VARBINARY(MAX) 将 HTML 文件保存在数据库中。
Convert a html file in binary file (code project link)
insert data in a column like this sample code :
将 html 文件转换为二进制文件（代码项目链接）
像这个示例代码一样在列中插入数据：
Declare @HTML Varbinary(MAX) = Set HTML Varbinary code here
Insert into table_name (htmlcoulmn)
Value @HTML
- Load data on the database ,when you need load file , you should convert htmlcolumn to Nvarchar(max) by this code :
- 在数据库上加载数据，当您需要加载文件时，您应该通过以下代码将 htmlcolumn 转换为 Nvarchar(max)：
Select CAST(htmlcolumn as nvarchar(MAX)) As HTMLCODE
FROM Table_Name
If this solution has a problem, thank you for writing me a comment.
如果此解决方案有问题，感谢您给我写评论。
I hope you for the best
我希望你最好
