VB Code:
Public Function XXSSFilter(ByVal UnfilteredText As String) As String
Const XXSS_ALLOWED_CHARS As String = " !$%*+,-./0123456789:=?@ABCDEFGHIJKLMNOPQRSTUVWXYZ\^_abcdefghijklmnopqrstuvwxyz|~"
'Filters strings to be sent to the client. Used to prevent XSS vulnerabilities
'Only certain characters need to be escaped.
Dim i As Integer
Dim sBuffer As String = ""
With UnfilteredText
'split the string into charachters. check if each character is in XCODE_ALLOWED_CHARS.
'if not, replace [character] with '&#[character #];'
For i = 0 To .Length - 1
If InStr(XXSS_ALLOWED_CHARS, .Chars(i), CompareMethod.Binary) = 0 Then
'escape the character
sBuffer += "&#" & Asc(.Chars(i)) & ";"
Else
'pass the character
sBuffer += .Chars(i)
End If
Next
Return sBuffer
End With
End Function