Safe way to save html to database - html

Question

I have a textarea in my page that is a HTML input field. The intention is to allow the user to register a confirmation HTML that will be shown in their users' browser after a certain action is taken place. You can imagine it as the confirmation of paypal after you pay something and it redirects you to a website that says "Thanks for your purchase". This is already implemented alright, but now I'm thinking about the user's security(XSS/SQL Injection).
What I want to know is how to filter out certain html tags such as <script> <embed> <object> safely inside my controller post action, so if I detect that there is a malicious html inside the HTML, I'll stop execution before saving. Right now I am doing like this:
[CustomHandleError]
[HttpPost]
[ValidateAntiForgeryToken]
[AccessDeniedAuthorize(Roles = "Admin,CreateMerchant")]
public ActionResult Create(MerchantDTO merchantModel)
{
if (ModelState.IsValid)
{
if (!IsSafeConfirmationHtml(merchantModel.ConfirmationHtml))
{
ModelState.AddModelError("ConfirmationHtml", "Unallowed HTML tags inputted");
return View("Create", merchantModel);
}
.
.
.
}
}
and my IsSafeConfirmationHTML is defined as
private bool IsSafeConfirmationHtml(string html)
{
if (html.ToLower().Contains("<script") || html.ToLower().Contains("<embed") || html.ToLower().Contains("<object"))
{
return false;
}
return true;
}
Is there a smarter, cleaner way to do this? I mean, I don't want to get false positives blocking the words "object", "script", etc, but I also don't want to be fooled by encodings that translate "<" to "%3C" or such...
Ontopic: does spacing inside tags works? Example: < script > alert("1"); < / script >?

Answer 1

So one thing you could do to defeat the encoding attack would be to run UrlDecode and HtmlDecode (html decode is probably superfluous, but it depends on what you do with the script) on it.
Another thing to speed up your checking would be to turn to a precompiled regex.
private static Regex disallowedHtml = new Regex(#"script|embed|object",
RegexOptions.IgnoreCase);
private bool IsSafeConfirmationHtml(string html)
{
Match match = disallowedHtml.Match(html);
return !match.success;
}
The static Regex instance cuts out most of the overhead of regex's for every run but the first one, making the regex match much faster than running 3 separate contains. You could make the regex complex enough to search for opening angle brackets, html entities and url encoded chars, match any whitespace between those chars and the actual tag name etc. etc. The Microsoft regex info has gotten quite good over the years.
I still wouldn't say this makes you 100% safe from a user (uploader? customer? the right word depends on what your business model is) running an XSS or injection attack against visitors to your site. They could point to an image or a css file that returns as mime-type x-application, or some such. And HTML is changing pretty rapidly these days. The best way to guarantee against that is to have a human involved in an approval process as well, but humans make mistakes and computers can be fooled, and there's no law that says those two events can't happen at the same time. But you are right to put some safeguards in place.