How do I avoid cross scripting flaws for script related tags in a VB.NET HTML web page

See more:

VB

Injection

XSS

For the below code, how do I resolve the cross scripting flaw? Is there a another way to write window.open?

<td align="right">
   <a class="button" 
      href="javascript:void(0);" 
      onclick="window.open('Displayxxxx.aspx?WID=<%=Request.QueryString("xxxx") %>','Displayxxx','width=800,height=500,menubar=0,toolbar=no,resizable=no,scrollbars=yes')">

      <input id="btnDisplayTaggedCode" class="button" type="button" value="xxxx" runat="server" visible="True"/>
   </a>
    
   <asp:Button runat="server" CssClass="button" Text="Close" ID="btnCancel"/>
</td>

What I have tried:

I have tried to add a

validateRequest="false"

in the page tag above