如何克服Asp.net中的跨站点脚本漏洞c＃

Question

正在处理的代码部分易受存储的XSS攻击。以下是代码。

 <asp:GridView ID="GridView1" runat="server" AutoGenerateColumns="False"     OnRowCancelingEdit="GridView1_RowCancelingEdit"    
        OnRowEditing="GridView1_RowEditing"  OnRowUpdating="GridView1_RowUpdating" OnRowDeleting="GridView1_OnRowDeleting"  OnPageIndexChanging="GridView1_PageIndexChanging"  Width ="1000px" class="grid">


   <Columns>   

        <asp:TemplateField HeaderText="User Name">   
            <ItemTemplate>   
                <asp:Label ID="lbl_Name" runat="server" Text='<%#Eval("Uname") %>'></asp:Label>   
            </ItemTemplate>   
            <EditItemTemplate>   
                <asp:TextBox ID="txt_Name" runat="server" Text='<%#Eval("Uname") %>'></asp:TextBox>   //this is the line vulnerable to XSS
            </EditItemTemplate>   
        </asp:TemplateField>       </columns>
</asp:GridView> 

背后的代码

 DataTable dt = new DataTable();
    try
    {
        SqlConnection con = new SqlConnection(conn);
        con.Open();
        SqlDataAdapter adapt = new SqlDataAdapter("Select Uid,Uname,Utype,Uemail,ClientName,ProjectName,Ulog from usrtable where ClientName='" + clientname + "' and Utype='Admin' or ClientName='" + clientname + "'and Utype='Normal'", con);
        adapt.Fill(dt);
        con.Close();
    }  

 if (dt.Rows.Count > 0)
            {
                GridView1.DataSource = dt;
                GridView1.DataBind();
            }

你能告诉我哪里出错了。是否在客户端，我将列名称绑定到gridview中的文本框？