Disable ALL Automatic HTML Escaping in ASP.Net/Core MVC

Question

In ASP.Net/Core MVC, the auto-HTML escaping happens when you echo a string variable inside a Razor view. For example:

<div>@("<b>Hello</b>")</div>

is output as

<div><b>Hello</b></div>

How can I disable this feature by default in ASP.Net/Core MVC, without having to use a helper everywhere like Html.Raw(), WriteLiteral(), new HtmlString(), et cetera?

I understand the reasoning behind this functionality but I am experimenting with alternate escape methods.

If you don't want what Razor does, you might want to not use Razor. — GSerg
– GSerg, Commented Apr 16, 2019 at 23:17
I think you can do it by replacing the service System.Text.Encodings.Web.HtmlEncoder in the services collection by a fake one. It is injected here. But it can have some side effects as it can be used elsewhere in aspnet framwork — Kalten
– Kalten, Commented Apr 16, 2019 at 23:40
@ibubi because if you enable HTML escaping for all data coming from your database, it negates the need for Razor to escape it everywhere. Now you have to remember to use the helper method at every single place you echo a variable, or else Razor will double-escape it. — user3163495
– user3163495, Commented Apr 18, 2019 at 15:18

Hien Nguyen · Accepted Answer · 2019-04-17 00:41:59Z

1

You can not disable it.

ASP.Net/Core MVC design for preventing Injection (Web Application Security), the @ use frequently so it need prevent HTML or Javascript injection.

answered Apr 17, 2019 at 0:41

Hien Nguyen

19k7 gold badges57 silver badges70 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Disable ALL Automatic HTML Escaping in ASP.Net/Core MVC

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related