Hi All,

We would like to use Microsoft AntiXss 3.1 to encode all user input (i.e. in QueryStrings on search & filter pages).

I have tested this using the following

<msxml:script language="C#" implements-prefix="lelo">
<msxml:assembly name="AntiXssLibrary" />
<msxml:using namespace="Microsoft.Security.Application" />       
<![CDATA[
public string antiXss(string querystring)
{
   return AntiXss.HtmlEncode(querystring);
}
]]>
</msxml:script>

As we have many XSLT files I don't really want to add this to each one, is there a more elegant solution?

Cheers,

Adrian