Question

Hi I have a MVC site and will have users inputting text to be displayed on a web page.
I am trying to come up with a graceful way of handling any HTML that the user try’s to input – as you will probably be aware MVC 2 throws an error for any HTML in the text.

I use ViewModels and decorate my properties with filters from the DataAnotation class to validate my forms.

Anybody now of such a way?

Is there some crazy regex that will NOT match HTML but anything else or some other way?

I am open to any suggestions.

Thanks,

Simon

Answer 1

Adding the following attribute will stop the runtime from complaining:

[ValidateInput(false)]
public ActionResult SomeEvilAction ()
{
    /* ... */
}

Now it’s your task to HTML encode every input you display back on a page:

<%= HttpUtility.HtmlEncode (Model.Text) %>

or

<%: Model.Text %>