title: How to solve Stored XSS issue reported by Checkmarx
body: <p>Codebase I am working on has been analyzed by Checkmarx, and it came back with a report containing a "Stored XSS" issue. The issue states: </p>
  
  <p>Method GetHomepageFilterByLocale HomepageRepo.cs gets data from the database, for the Select element. This element’s value then flows through the code without being properly filtered or encoded and is eventually displayed to the user in method GetProductsByFilterType HomepageController.cs. This may enable a Stored Cross-Site-Scripting attack.</p>
  
  <p>Is there a standard recommended way to resolve this issue? </p>
  
  <p>Please see below code snippets for the both mentioned methods.</p>
  
  <p><strong>HomepageRepo.cs</strong></p>
  
  <pre><code>public HomepageFilter GetHomepageFilterByLocale(int localeId)
      {
          return _context.HomepageFilter.SingleOrDefault(x =&gt; x.LocaleId == localeId);
      }
  </code></pre>
  
  <p><strong>HomepageController.cs</strong></p>
  
  <p>GetHomepageViewModel() method is where the repository method is called.</p>
  
  <pre><code>[HttpGet]
      public ActionResult GetProductsByFilterType(int locale, string filterType)
      {
          HomepageViewModel model = GetHomepageViewModel(locale, filterType);
  
          if (model?.Products != null)
          {
              model.Products.ForEach(p =&gt; p.Name = HttpUtility.HtmlEncode(p.Name));
              model.Products.ForEach(p =&gt; p.ImageUrl = HttpUtility.HtmlAttributeEncode(p.ImageUrl));
          }
  
          return Json(model, JsonRequestBehavior.AllowGet);
      }
  </code></pre>