Q:

How to filter out hazardous characters from input coming from xml file in ASp.Net 2.0 c#?

I have an xml file with item containing URL with parameter. This parameter will be used in another page and accessed through Request.QueryString(). 
Doing AppScan, it is found out to be hazardous and need to filter hazardous characters from user input.  How can I do this? Examples of the xml file item with the URL: 
<item Text="Test" navigate="Test.aspx?Param=TestList" /> 

or
<item Text="Test1" navigate="Test1.aspx?Param=TestList;age=5;weight=9" />

Any help? 

A:

If your XML is controlled by you (as site owner) and users can't change it than you don't need to filter out anything out of it - just don't put scripts in the XML.
Your actual problem seem to be that pages (like Test.aspx) render query parameter non-escaped (or incorrectly escaped). You should fix this pages as users(hackers) can type in any urls to your site.
I recommend to read on XSS prevention in general. Having very strict list of what query parameters can accept is one of the simplest fixes (i.e. "age" must be integer).

