Hi supporter.

I am using WebForm Asp.net to develop application.

My code looks like:

      var hlkFile = new HyperLink

      {

        ID = "hlkFile_" + fieldInfo.Name,

        Text = fileUploadInfo.Filename,

        NavigateUrl = "#"

      };

And Veracode pointed out that my code has problem with XSS.

Then I changed my code to:

      var hlkFile = new HyperLink

      {

        ID = HttpUtility.HtmlAttributeEncode("hlkFile_" + fieldInfo.Name),

        Text = HttpUtility.HtmlAttributeEncode(fileUploadInfo.Filename),

        NavigateUrl = "#"

      };

BUT Veracode still pointed out that my code has problem with XSS (CWE 80)

Can you help me understand why my code still have problem with XSS and how should I do for my code?

Thank you very much for your support

Yours.

Nghia