What is an MvcHtmlString and when should I use it?

by

ASP.NET 4 introduces a new code nugget syntax <%: %>. Essentially, <%: foo %> translates to <%= HttpUtility.HtmlEncode(foo) %>. The team is trying to get developers to use <%: %> instead of <%= %> wherever possible to prevent XSS.

However, this introduces the problem that if a code nugget already encodes its result, the <%: %> syntax will re-encode it. This is solved by the introduction of the IHtmlString interface (new in .NET 4). If the foo() in <%: foo() %> returns an IHtmlString, the <%: %> syntax will not re-encode it.

MVC 2’s helpers return MvcHtmlString, which on ASP.NET 4 implements the interface IHtmlString. Therefore when developers use <%: Html.*() %> in ASP.NET 4, the result won’t be double-encoded.

Edit:

An immediate benefit of this new syntax is that your views are a little cleaner. For example, you can write <%: ViewData["anything"] %> instead of <%= Html.Encode(ViewData["anything"]) %>.

More Related Contents:

  1. better way to load 2 dropdown in mvc
  2. Restarting (Recycling) an Application Pool
  3. How do I use a C# keyword as a property name?
  4. ASP.NET MVC Binding to a dictionary
  5. Dependency Injection in attributes
  6. How to get the public IP address of a user in C#
  7. How to call another controller Action From a controller in Mvc
  8. Web API Put Request generates an Http 405 Method Not Allowed error
  9. Correct, idiomatic way to use custom editor templates with IEnumerable models in ASP.NET MVC
  10. When I post back to my controller all values for my model are null
  11. Validation failed for one or more entities while saving changes to SQL Server Database using Entity Framework
  12. prevent property from being serialized in web API
  13. How to update a claim in ASP.NET Identity?
  14. ModelState.IsValid == false, why?
  15. Posting JSON Data to ASP.NET MVC
  16. How to override an existing extension method
  17. How to flatten an ExpandoObject returned via JsonResult in asp.net mvc?
  18. MVCBuildViews not working correctly
  19. I want to understand the lambda expression in @Html.DisplayFor(modelItem => item.FirstName)
  20. ASP.NET Web API : Correct way to return a 401/unauthorised response
  21. Write PDF stream to response stream
  22. Do asynchronous operations in ASP.NET MVC use a thread from ThreadPool on .NET 4
  23. ‘object’ does not contain a definition for ‘X’
  24. How to redirect to Index from another controller?
  25. MVC 5 BeginCollectionItem with Partial CRUD
  26. How to manually validate a model with attributes?
  27. How to retain spaces in DropDownList – ASP.net MVC Razor views
  28. Model binding with nested child models and PartialViews in ASP.NET MVC
  29. How to use SqlClient in ASP.NET Core?
  30. How can I maintain ModelState with RedirectToAction?

Leave a Comment