The book says to download AntiXSS 4.1, but only 4.0 is available on the cited website. May I assume that, having downloaded 4.0, not changing the Html.Encode calls to a proprietary encoder class explains why I get an error message, and that it doesn't work? I am sure that I downloaded the .msi, installed, copied to a "Dependencies" folder in the tutorial project, and added the reference (which appears in reference).

Configuration Error

Description: An error occurred during the processing of a configuration file required to service this request. Please review the specific error details below and modify your configuration file appropriately.

Parser Error Message: Could not load file or assembly 'AntiXSSLibrary.dll' or one of its dependencies. The system cannot find the file specified.

Source Error:

Line 11: </appSettings>Line 12: <system.web>Line 13: <httpRuntime encoderType="AntiXSSEncoder, AntiXSSLibrary.dll"/>Line 14: <compilation debug="true" targetFramework="4.0">Line 15: <assemblies>

So this is my fault, as I'm the owner of AntiXSS. When Jon was writing that chapter we had planned to release 4.1 before the book. Unfortunately we've not managed that as yet (for various reasons)

The source for 4.1 (beta) is available, so you can download it from wpl.codeplex.com and compile it up yourself, and then use that binary as Jon as described.

or if you just don't want to download the beta you could always just download the nuget package and create your own encoder.
Which I did using the post here: http://haacked.com/archive/2010/04/0...r-asp-net.aspx