var anchor = string.Format("<a href='{0}'>My Safe Link</a>",
Request.QueryString["Url"]);
Response.Write(anchor);
The above code is not safe and is vulnerable to an XSS attack. If you are using the AntiXSS library you might assume that calling the HtmlEncode or HtmlAttributeEncode methods will protect you. One of the reasons these methods will not protect you is a result of an attack string that most developers forget about:
javascript:alert('')
If the query string parameter Url is set to the above string then an alert dialog will appear when the anchor is clicked. Again, the code that would allow the XSS is using the AntiXSS library and even calling the HtmlAttributeEncode method, as shown below.
var anchor = string.Format("<a href='{0}'>My Safer Link</a>",
AntiXss.HtmlAttributeEncode(Request.QueryString["Url"]));
Response.Write(anchor);
If you are using the AntiXSS library you actually will want to call GetSafeHtmlFragment to get a safe anchor. So your anchor declaration should look like the following.
var anchor = AntiXSS.GetSafeHtmlFragment(
string.Format("<a href='{0}'>My Safest Link</a>",
Request.QueryString["Url"]));
I hope this post serves as a friendly reminder that HtmlEncode is not an end all solution, which is a reason why several different methods exist for sanitizing input. Also keep in mind that there is going to be more overhead with GetSafeHtmlFragment than with HtmlEncode. If that is an issue for you, then you may want to roll a custom sanitation method for your needs. Actually, it might be a good idea for AntiXSS to offer granular sanitation solutions, such as GetSafeHref.