Hello,

please note that the filterflags are not all designed to work together e.g. it does not make sense to use the sql injection ones with the ones intended for output. In general

•  If you're using dynamic sql (i.e. concatenating sql strings together) then you make use of NoSQL
•  If however, you are accepting user input and planning on writing it to the screen/database then you have to decide what level of html you support.
  •  If you do not plan on supporting html at all (e.g. if you're reading from a textbox which contains a users name, there is no need to support html), then use NoMarkup (as it will encode the content).
  • If however you need to support html in user input (e.g. if you're allowing html in a forum post etc.), then you use NoScripting to strip dangerous cross-site scripting javascript.
• you do not need to use the NoAngleBrackets filter - it was added as a request for a major military dotnetnuke user to pass a flawed security audit - it does not add any additional security benefits

If you feel that there is an issue in the filtering code, please email your code and text to security@dotnetnuke.com so we can evaluate it.

Cathal

Cathal