Question

i have a login view in asp.net-mvc. i want that user cannot able to enter tag in username or password field

Answer 1

Why would you want preventing the user from entering tags? Leave him enter whatever he wants. Why preventing someone from having a password such as <script>alert('hello');</script> – it looks like a pretty strong password. Personally I hate web sites limiting my choices for a password.

Just make sure that you encode everything you are outputting inside the views:

So instead of:

<div>Hello <%= Model.Username %></div>

Always use:

<div>Hello <%= Html.Encode(Model.Username) %></div>

or:

<div>Hello <%: Model.Username %></div>

if you are working with ASP.NET 4.0

Also, as pointed out by @Jab in the comments section, in order to accept such input from the user you might need to decorate the controller action that will handle the submission with the [ValidateInput(false)] attribute.