How to prevent dangerous characters from .net

Question

I have developed a mobile application where the back end of it is .net framework. I need to validate the data coming to the backend are presence of dangerous characters such as

<>&%;={}()

If those type of characters present I need to terminate the request and send an error message

Put another way, what is the set of _valid_ characters, and why is that the set? — ClickRick, Feb 10 '20 at 08:48
@Udara, I guess you should add the purpose of restricting those characters to your question. If you'd like to prevent having HTML in your string, that's a different story, for JS it's another, for storing files, for SQL, they are completely different. Knowing the purpose would make it easier for us to help you. — Just Shadow, Feb 10 '20 at 09:10

score 3 · Accepted Answer · answered Feb 10 '20 at 08:33

If Regex is not a requirement, then you could write a stringextension that returns a bool indicating if the value is valid or not.

public static class StringExtensions
{
    private static char[] invalidChars = { '<', '>', '&', '%', ';', '=', '{', '}', '(', ')' };

    public static bool IsValid(this string value)
    {
        if (value == null)
        {
            return false;
        }

        foreach (char c in invalidChars)
        {
            if (value.Contains(c))
            {
                return false;
            }
        }

        return true;
    }
}

Then you can check it like this:

static void Main(string[] args)
{
    string validString = "Hello World";
    string invalidString = "Hello (World)";

    Console.WriteLine($"{validString} --> {validString.IsValid()}");
    Console.WriteLine($"{invalidString} --> {invalidString.IsValid()}");
}

The code above produces this result:

I like your approach for suggesting Extension method. – Benjamin Feb 10 '20 at 08:39 — Benjamin, Feb 10 '20 at 08:39

Just Shadow · Answer 2 · 2020-02-10T09:47:37.647

You can achieve that by using .Net's Regex.Replace() method.
Try something like this:

using System;
using System.Text.RegularExpressions;

public class Example
{
    public static void Main()
    {
        string input = @"(a>da <asd> fds&sd fsdf%dsf;sd f=sdf{sdf} asd(as)dfs";
        // NOTE: REPLACE the pattern with the one you need
        string pattern = @"<|>|&|%|;|=|{|}|\(|\)";
        string replacement = "";
        string result = Regex.Replace(input, pattern, replacement);

        Console.WriteLine("Original String: {0}", input);
        Console.WriteLine("Replacement String: {0}", result);                             
    }
}

How to prevent dangerous characters from .net

2 Answers2