Telerik RadGrid 控件如何防止XSS Attack

最新推荐文章于 2025-04-08 17:22:17 发布

kissjob

最新推荐文章于 2025-04-08 17:22:17 发布

阅读量2.2k

点赞数

分类专栏： Thirdparty Tool 文章标签： function server asp.net exception javascript object

本文链接：https://blog.youkuaiyun.com/kissjob/article/details/5075707

版权

Thirdparty Tool 专栏收录该内容

3 篇文章

订阅专栏

本文介绍如何在RadGrid控件中进行服务器端及客户端的数据绑定，并通过HtmlEncode和JavaScript escape函数确保显示数据的安全性。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

一：对于服务器端的数据绑定设置，可以：

1）如果是：RadGrid control(RadGrid for asp.net ajax) 版本，则使用HtmlEncode 属性。

<telerik:GridBoundColumn UniqueName="Description" DataField="Description" HtmlEncode="true" />

</Columns>

</MasterTableView>

2）如果(RadGrid for asp.net)，只能在ItemDataBound事件中，手动实现了：

protected void RadGrid1_ItemDataBound(object sender, GridItemEventArgs e)

{

if (e.Item is GridDataItem)

{

GridDataItem dataItem = (GridDataItem)e.Item;

if (!e.Item.IsInEditMode)

{

dataItem["BoundColumnUniqueName"].Text = Server.HtmlEncode(dataItem["BoundColumnUniqueName"].Text);

}

二：对于客户器端的数据绑定设置，使用JavaScript的escape Function() 来实现 （http://www.telerik.com/community/forums/aspnet-ajax/grid/htmlencode-true-not-honoured-on-a-gridboundcolumn-when-using-clientside-data-binding.aspx）

</ClientSettings>

in aspx.cs file

public partial class _Default : System.Web.UI.Page
{
protected void Page_Load(object sender, EventArgs e)
{

}

    [WebMethod]
    public static List<Customer> GetData()
    {
        DataClassesDataContext context = new DataClassesDataContext();
        return context.Customers.Take(10).ToList();
    }
}

in aspx file

<head runat="server">
    <title></title>
    <telerik:RadScriptBlock runat="server" ID="RadScriptBlock1">
        <script type="text/javascript">
            function pageLoad()
            {
                PageMethods.GetData(loadGrid);
            }

            function loadGrid(result)
            {
                result = ensureDataSource(result);
                var grid = $find("<%=RadGrid1.ClientID %>");
                grid.get_masterTableView().set_dataSource(result);
                grid.get_masterTableView().dataBind();
            }

            function ensureDataSource(result)
            {
                for (var i = 0, j = result.length; i < j; i++)
                {
                    //ensure current item i.e. result[i] escape();
                }

                return result;
            }
        </script>
    </telerik:RadScriptBlock>
</head>
<body>
    <form id="form1" runat="server">
    <asp:ScriptManager runat="server" ID="ScriptManager1" EnablePageMethods="true"></asp:ScriptManager>
    <div>

    <telerik:RadGrid runat="server" ID="RadGrid1"
        AllowPaging="true" AllowFilteringByColumn="true">
        <MasterTableView AutoGenerateColumns="False" CellSpacing="-1" DataKeyNames="CustomerID"
                    >
            <Columns>
                <telerik:GridBoundColumn DataField="CustomerID" HeaderText="CustomerID"
                    ReadOnly="True" SortExpression="CustomerID" UniqueName="CustomerID">
                </telerik:GridBoundColumn>
                <telerik:GridBoundColumn DataField="CompanyName" HeaderText="CompanyName"
                    SortExpression="CompanyName" UniqueName="CompanyName">
                </telerik:GridBoundColumn>
                <telerik:GridBoundColumn DataField="ContactName" HeaderText="ContactName"
                    SortExpression="ContactName" UniqueName="ContactName">
                </telerik:GridBoundColumn>
                <telerik:GridBoundColumn DataField="ContactTitle" HeaderText="ContactTitle"
                    SortExpression="ContactTitle" UniqueName="ContactTitle">
                </telerik:GridBoundColumn>
            </Columns>
        </MasterTableView>
        <ClientSettings>
            <ClientEvents OnCommand="function(){}" />
        </ClientSettings>
    </telerik:RadGrid>

    </div>
    </form>
</body>