Question

I am just wondering if I have to worry about encoding the values that get output when I use HTML helpers like Html.DropDownList().

If so, how do I encode them? It’s easy to do if I were building the drop down manually — just wrap each value with ‘Html.Encode()‘. However, I don’t know how to do this when using HTML helpers.

Answer 1

It looks like the values are encoded automatically, so there’s no reason to do it yourself. Here’s a snippet from the actual ASP.NET MVC 1.0 source code that you can download from codeplex (in SelectExtensions.cs):

    private static string ListItemToOption(SelectListItem item) {         TagBuilder builder = new TagBuilder('option') {             InnerHtml = HttpUtility.HtmlEncode(item.Text)         };         if (item.Value != null) {             builder.Attributes['value'] = item.Value;         }         if (item.Selected) {             builder.Attributes['selected'] = 'selected';         }         return builder.ToString(TagRenderMode.Normal);     }