title: Vulnerability scanner for asp.net flags cross site scripting
body: <p>I am running netspark vulnerability test and it flags following url</p>
  
  <blockquote>
    <p><a href="http://localhost:54923/search/" rel="nofollow noreferrer">http://localhost:54923/search/</a>'ns='netsparker(0x005AAD)</p>
  </blockquote>
  
  <p>I am not able to understand what <code>'ns='netsparker(0x005AAD)</code> is this part or how to fix this issue i am sanitizing input <code>/search/searchkeyword</code> to make user ENcoding the input also</p>
  
  <p>User enter the keyword in search input box and then page is redirected with search page with the search keyword <code>http://localhost:54923/search/apple</code></p>
  
  <p>1>  it doesn't contain and JS script</p>
  
  <pre><code> if (filterInput.Contains("onmouseover") || filterInput.Contains("script") || filterInput.Contains("&lt;/style&gt;") || filterInput.Contains("&lt;/script&gt;") || filterInput.Contains("&lt;") || filterInput.Contains("%3c") || filterInput.Contains("?") || filterInput.Contains("%3f") || filterInput.Contains("alert") )
              {
                  search = System.Web.HttpUtility.HtmlEncode(filterInput);
                  Response.Write("Invalid Search");
                  Response.End();
              }
  </code></pre>
  
  <p>2> I am adding below line to web.config to make it bit more secure</p>
  
  <pre><code>&lt;httpRuntime targetFramework="4.5" requestValidationMode="2.0" enable="true"  encoderType="System.Web.Security.AntiXss.AntiXssEncoder,System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"/&gt;
  </code></pre>
  
  <p>Based on this i have few question</p>
  
  <ol>
  <li>What is 'ns='netsparker(0x005AAD) in the url does it represent js</li>
  <li>How can i prevent this</li>
  <li>Measures which i have taken is fine or i need to do more.</li>
  </ol>
  
  <p>After adding few security steps, netsparket still flags it as xss. How can i fix this so that its not flagged</p>