Should I html encode values in an input field?

Question

Which should I use?

<input type="hidden" name="first_name" 
value="<%= person.first_name %>" />

or

<input type="hidden" name="first_name" 
value="<%= Html.Encode( person.first_name ) %>" />

AnthonyWJones · Accepted Answer · 2009-01-09 15:36:56Z

6

You should Html.Encode else a " in the field could lead to injection problems

answered Jan 9, 2009 at 15:36

AnthonyWJones

190k35 gold badges236 silver badges307 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Gumbo · Accepted Answer · 2009-01-09 15:37:30Z

1

If you want to set a default value for an HTML element, you have to encode the HTML special characters inside the value using character references.

answered Jan 9, 2009 at 15:37

Gumbo

657k112 gold badges792 silver badges852 bronze badges

Gumbo can u please go to chat I have small question regarding this answer of yours

Hi. sorry . waited long time :-) can u please try again ? I'll wait.