Question

I think knockout handles this situation, but wanted to confirm. Is it true that if using the value binding w/ a form control like input/textarea that there is no danger of a script injection attack?

Or do you need to do something to ensure the value is encoded prior to setting it in the view model?

Answer 1

The value will be saved to the view model, as is. It just depends how you use it. The text binding will encode the content based on using innerText/textContent to set the value. So, you are safe there. If you were to use the html binding with content that was set via the value binding, then it would be possible to inject a script.

See the Knockout doco About HTML encoding for more info.