HttpResponse.Write Method (String)

Writes a string to an HTTP response output stream.

Namespace: System.Web
Assembly: System.Web (in system.web.dll)

public void Write (
	string s
public void Write (
	String s
public function Write (
	s : String
Not applicable.



The string to write to the HTTP output stream.

Dynamically generated HTML pages can introduce security risks if input received from Web clients is not validated either when it is received from a client or when it is transmitted back to a client. Malicious script that is embedded in input submitted to a Web site and later written back out to a client can appear to be originating from a trusted source. This security risk is referred to as a cross-site scripting attack. You should always validate data that is received from a client when it will be transmitted from your site to client browsers.

Moreover, whenever you write out as HTML any data that was received as input, you should encode it using a technique such as HtmlEncode or UrlEncode to prevent malicious script from executing. This technique is useful for data that was not validated when it was received.

When you encode or filter data, you must specify a character set for your Web pages so that your filter can identify and remove any byte sequences that do not belong to that set (such as nonalphanumeric sequences) and could potentially have malicious script embedded in them.

For more information about cross-site scripting attacks, see MSDN article Q252985 at

The following example echoes the client's name back to the client's browser. HtmlEncode strips any malicious script and invalid characters that may have been submitted in the UserName input field.

Response.Write("Hello " + Server.HtmlEncode(Request.QueryString["UserName"]) + "<br>");

Windows 98, Windows Server 2000 SP4, Windows Server 2003, Windows XP Media Center Edition, Windows XP Professional x64 Edition, Windows XP SP2, Windows XP Starter Edition

The Microsoft .NET Framework 3.0 is supported on Windows Vista, Microsoft Windows XP SP2, and Windows Server 2003 SP1.

.NET Framework

Supported in: 3.0, 2.0, 1.1, 1.0

Community Additions