using System;

using System.Web;

public class Program

{

    public static void Main()

    {

        //Bad actor could do this

        Sanitize(@"http://dan.com?oa\n1\r2\n\r3");

​

​

        //Bad actor can't do this in a querystring value

        Sanitize(@"http://dan.com?oa

1

2

3");

        //Bad actor can do this, but decoded value is safe

        Sanitize(@"http://dan.com?oa%0A1%02%0A3");

    }

    public static void Sanitize(string text){

        Console.WriteLine(text);

        var encodedText = HttpUtility.UrlEncode(text);

        Console.WriteLine(encodedText);

        var safeText = encodedText.Replace("%5cn", String.Empty).Replace("%5cr", String.Empty);

        // var safeText = encodedText.Replace("%5cn%5cr",String.Empty).Replace("%5cn", String.Empty).Replace("%5cr", String.Empty);

        Console.WriteLine(safeText);

        var decodedSafeText = HttpUtility.UrlDecode(safeText);

        Console.WriteLine(decodedSafeText);

        Console.WriteLine(String.Empty);

    }

}