I've got safe/sanitized HTML saved in a DB table.
How can I have this HTML content written out in a Razor view?
It always escapes characters like < and ampersands to &.
-
To save people like me trying to do this with with anonymous types in dynamically typed views, where this won't work - see this answer to my more-specific question. Although using this approach with a strongly-typed view is still better if your situation allows.brichins– brichins2015-07-09 01:00:00 +00:00Commented Jul 9, 2015 at 1:00
Add a comment
|
7 Answers
Supposing your content is inside a string named mystring...
You can use:
@Html.Raw(mystring)
Alternatively you can convert your string to HtmlString or any other type that implements IHtmlString in model or directly inline and use regular @:
@{ var myHtmlString = new HtmlString(mystring);}
@myHtmlString
9 Comments
Gui
Hi Sergio. I'm using MVC 3 and i'm using the Raw method properly.
Todd Richardson
Thank you for the answer! I'm still learning MVC 3 and this was eluding me.
Chris Snowden
@Lorenzo, +1 I'm using the latest MVC 3 with
razor syntax and Html.Raw is definitely available to me.
Alexei Levenkov
Lorenzo, I've updated answer to remove mentioning of MVC Beta as it was some years ago. Feel free to revert/change.
|
You can use
@{ WriteLiteral("html string"); }
2 Comments
shanabus
This was awesome for me, was using Razor within a Hangfire app to send emails...
Html.Raw() doesn't work there
Muhammed Basil
1 for WriteLiteral
In ASP.NET MVC 3 You should do something like this:
// Say you have a bit of HTML like this in your controller:
ViewBag.Stuff = "<li>Menu</li>"
// Then you can do this in your view:
@MvcHtmlString.Create(ViewBag.Stuff)
1 Comment
37Stars
I prefer this method because HTML.Raw blows up if the passed string is null.
Sometimes it can be tricky to use raw html. Mostly because of XSS vulnerability. If that is a concern, but you still want to use raw html, you can encode the scary parts.
@Html.Raw("(<b>" + Html.Encode("<script>console.log('insert')</script>" + "Hello") + "</b>)")
Results in
(<b><script>console.log('insert')</script>Hello</b>)
Comments
You can put your string into viewdata in controller like this :
ViewData["string"] = DBstring;
And then call that viewdata in view like this :
@Html.Raw(ViewData["string"].ToString())
Comments
Apart from using @MvcHtmlString.Create(ViewBag.Stuff)
as suggested by Dommer, I suggest you to also use AntiXSS library as suggested phill http://haacked.com/archive/2010/04/06/using-antixss-as-the-default-encoder-for-asp-net.aspx
It encodes almost all the possible XSS attack string.
Comments
Complete example for using template functions in RazorEngine (for email generation, for example):
@model SomeModel
@{
Func<PropertyChangeInfo, object> PropInfo =
@<tr class="property">
<td>
@item.PropertyName
</td>
<td class="value">
<small class="old">@item.OldValue</small>
<small class="new">@item.CurrentValue</small>
</td>
</tr>;
}
<body>
@{ WriteLiteral(PropInfo(new PropertyChangeInfo("p1", @Model.Id, 2)).ToString()); }
</body>
