title: Filtering Encoded XSS in Classic ASP
body: <p>ok. I am dealing with a Classic ASP app written on VBScript. I am trying to filter possible XSS that might come via encoded Query string.</p>
  
  <p>I have a simple XSS elimination function in place [getUserInput]. This looks for special charactors like &lt; > / ' .... and replaces them with blank space. That works pretty well.</p>
  
  <p>But, when I input something that is encoded via Server.URLEncode (VBScript) or escape (Javascript), obviously my above filter does not work. </p>
  
  <p>I want to know the recommended solutions that are in place to prevent this Unicode converted input that makes my page vulnerable to XSS.</p>
  
  <p>Repro steps:</p>
  
  <pre><code>&lt;%
  Response.Write getUserInput(Request("txt1")) + "&lt;br/&gt;"
  Response.Write Server.URLEncode(getUserInput(Request("txt1"))) + "&lt;br/&gt;"
  'the below line is where I am trying to decode and echo the input
  Response.Write URLDecode2((getUserInput(Request("txt1")))) + "&lt;br/&gt;"
  Response.Write "&lt;br/&gt;"
  %&gt;
  
  &lt;html&gt;
  Try any of the below two encoded strings in the input box and hit the button. &lt;/br&gt;&lt;/br&gt;
  alert('hi') &lt;/br&gt;
  %3Cscript%3Ealert%28%27hi%27%29%3C%2Fscript%3E  &lt;br/&gt;
  alert(document.cookie) &lt;/br&gt;
  %3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E &lt;br/&gt; 
  &lt;/br&gt;
  &lt;form method="get" name="form1" id="form1" action="#" onSubmit="CallOnLoad()"&gt;
      &lt;input type='text' name='txt1' id='txt1' /&gt;
      &lt;button name='btn' type='submit' id='btn'&gt;Hitme&lt;/button&gt;
  &lt;/form&gt;
  &lt;/html&gt;
  
  &lt;%
  function getUserInput(input)
  
  dim newString
  newString=input  
  newString    = replace(newString,"--","")
  newString    = replace(newString,";","")          
    newString    = replace(newString,chr(34),"'") 
    newString    = replace(newString,"'","") 
    newString    = replace(newString,"=","=") 
    newString    = replace(newString,"(","[") 
    newString    = replace(newString,")","]")
    newString = replace(newString,"'","''")
    newString = replace(newString,"&lt;","[")
    newString = replace(newString,"&gt;","]")  
    newString = replace(newString,"/*","/") 
    newString = replace(newString,"*/","/")
    getUserInput = newString
  
  end function
  %&gt;
  &lt;%
  'URLDecode2 - source code from http://www.motobit.com/tips/detpg_URLDecode/ 
  Function URLDecode2(ByVal What)
  
    Dim Pos, pPos
    What = Replace(What, "+", " ")
    on error resume Next
    Dim Stream: Set Stream = CreateObject("ADODB.Stream")
    If err = 0 Then 
      on error goto 0
      Stream.Type = 2 'String
      Stream.Open
      Pos = InStr(1, What, "%")
      pPos = 1
      Do While Pos &gt; 0
        Stream.WriteText Mid(What, pPos, Pos - pPos) + _
          Chr(CLng("&amp;H" &amp; Mid(What, Pos + 1, 2)))
        pPos = Pos + 3
        Pos = InStr(pPos, What, "%")
      Loop
      Stream.WriteText Mid(What, pPos)
      Stream.Position = 0
      URLDecode2 = Stream.ReadText
      Stream.Close
    Else 'URL decode using string concentation
      on error goto 0
      Pos = InStr(1, What, "%")
      Do While Pos&gt;0 
        What = Left(What, Pos-1) + _
          Chr(Clng("&amp;H" &amp; Mid(What, Pos+1, 2))) + _
          Mid(What, Pos+3)
        Pos = InStr(Pos+1, What, "%")
      Loop
      URLDecode2 = What
    End If
  End Function
  %&gt;
  </code></pre>
  
  <p>I am required to host the app on IIS 7.5/Win 2008 R2.
  Simple/elegant advices please?</p>
  
  <p><a href="http://msdn.microsoft.com/en-us/library/ff649310.aspx" rel="nofollow" title="How To: Prevent Cross-Site Scripting in ASP.NET">How To: Prevent Cross-Site Scripting in ASP.NET</a> is a good article, but it does not quiet to my scenario as I am dealing with Classic ASP.</p>
  
  <p>Thanks.</p>