Html Encoding in ASP.NET MVC

Question

I have the following code in a view (Demo.aspx) within a ASP.NET MVC 2 project:

Demo.aspx:

<% if (!Model.IsValid) { %><%= Model.FirstName %> - <% } %><%= Model.LastName %> -

I am trying to convert it to razor view (Demo.cshtml) in the process of migrating the project from ASP.NET MVC2 to ASP.NET MVC3. After doing some analysis and following the URL: http://haacked.com/archive/2011/01/06/razor-syntax-quick-reference.aspx/ for migration of the webforms to razor view, I drafted the following code equivalent in razor view:

Demo.cshtml:

@if (!Model.IsValidName)
        { @Html.Raw(Model.FirstName)
            @Html.Raw("-")
        }
        @Html.Raw(Model.LastName)
        @Html.Raw("-")

But by using the conversion tool : http://visualstudiogallery.msdn.microsoft.com/d2bfd1ca-9808-417c-b963-eb1ea4896790 , I got the following code:

Demo.cshtml:

@if (!Model.IsValidName)
           { @Model.FirstName
        @Html.Raw("-")
         } @Model.LastName
        @Html.Raw("-")

Can anyone help to confirm which of the above is correct?

Fields used in the generated code seem to have nothing to do with your actual model — Andrei
– Andrei, Commented Aug 6, 2014 at 10:07
Thanks for your reply. I take your answer (Second answer) based on the fact that Razor expressions are automatically HTML encoded. Correct me in case I am wrong. — santosh kumar patro
– santosh kumar patro, Commented Aug 6, 2014 at 10:18

hutchonoid · Accepted Answer · 2014-08-06 10:19:16Z

1

I would recommend the second approach:

@if (!Model.IsValidName)
           { @Model.FirstName
        @Html.Raw("-")
         } @Model.LastName
        @Html.Raw("-")

The reason for this is for security purposes.

As an example the @Model.FirstName will prevent against an XSS attack where as @Html.Raw(Model.FirstName) is circumventing the encoding and making it possible if a user is allowed to update their own FirstName property.

answered Aug 6, 2014 at 10:19

hutchonoid

33.4k15 gold badges102 silver badges106 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Html Encoding in ASP.NET MVC

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related