Questions about Javascript injection
I been reading on asp.net mvc learning site about JavaScript injection and man it is an eye opener.

I never even realized/thought about someone using JavaScript to do some weird ass injection attacks.

It however left me with some unanswered questions.


First

When do you use html.encode? Like do you use it only when you are going to display information that that user or some other user had submitted?

Or do I use it for everything. Like say I have form that a user submits, this information will never be displayed to any of the users, should I be still using html.encode? 

How would I do it like I am not sure how to put inside say and Html.TextBox() the html.encode tag.


Second

What happens say I have on my site a rich html editor. The user is allowed to use it and make things bold and whatever. Now I want to display information back to the user through a label. I can't Html.Encode it since then all the bold and stuff will not be rendered.

Yet I can't leave it like it is since what would stop a user to add some Javascript attack?

So what would I do? Use Regex to filter out all <script> tags?


Third 

There is also another tag you can use called "AntiforgeryToken" when would you use this one?

Thanks


Questions about Javascript injection
===

I been reading on asp.net mvc learning site about JavaScript injection and man it is an eye opener.

I never even realized/thought about someone using JavaScript to do some weird ass injection attacks.

It however left me with some unanswered questions.


First

When do you use html.encode? Like do you use it only when you are going to display information that that user or some other user had submitted?

Or do I use it for everything. Like say I have form that a user submits, this information will never be displayed to any of the users, should I be still using html.encode? 

How would I do it like I am not sure how to put inside say and Html.TextBox() the html.encode tag.


Second

What happens say I have on my site a rich html editor. The user is allowed to use it and make things bold and whatever. Now I want to display information back to the user through a label. I can't Html.Encode it since then all the bold and stuff will not be rendered.

Yet I can't leave it like it is since what would stop a user to add some Javascript attack?

So what would I do? Use Regex to filter out all <script> tags?


Third 

There is also another tag you can use called "AntiforgeryToken" when would you use this one?

Thanks

