Question

I am using FckEditor in Create.aspx page in asp.net mvc application.

Since I need to show rich text in web pages, I used ValidateInput(false) attribute top of action method in controller class.

And I used Html.Encode(Model.Message) in Details.aspx to protect user’s attack.

But, I had result what I did not want as following :

<p> Hello </p>

I wanted following result not above :

Hello

How can I show the text what user input?

Thanks in advance

Answer 1

The short answer is that HTMLEncode is making your markup show like that. If you don’t HTMLEncode, it will do what you want.

You need to think about whether or not you need full control of markup, who is entering the markup, and if an alternative like BBCode is an option.

If your users using the editor are all sure to be ‘safe’ users, then XSS isn’t likely to be as much a concern. However, if you are using this on a comment field, then BBCode, or something like SO itself uses is more appropriate.

You wont be able to use a WYSIWYG editor and do HTMLEncode though… (without BBCode, or some other token system)