Question

I would like to display "[e-mail]" at the browser. I know it’s unsafe to display email address like that. So, when we view source it appear as a javascript.Is this possible with razor. I use to work like that with codeigniter php framework safe_email() when displaying email address in browser.

Answer 1

The fact you’re using Razor is irrelevant. The only way to keep email addresses safe from address harvesters is to obfuscate it in the page, then use client-scripting to deobfuscate it for appropriate clients. I like to use human-readable obfuscation as not to lock-out users with scripting disabled. This is what I do (using MVC WebForms syntax):

String emailAddress = "[e-mail]";

public static String Escape(String s) {
    StringBuilder sb = new StringBuilder();
    foreach(Char c in s) {
        sb.Append('%');
        Int32 ic = (Int32)c;
        String hex = ic.ToString("X2"); // convert to hexadecimal
        sb.Append( hex );
    }
    return sb.ToString();
}

<span id="email"><%= Html.Encode( emailAddress.Replace("@", "REMOVE@CAPITALIZED") ) %></span>

<script type="text/ecmascript">
    document.getElementById("email").innerText = unescape("<%= Escape( emailAddress ) %>" );
</script>

Escaping text shields them from harvesters, but the script will automatically reveal it in any competent browser. Users without scripts will see a human-readable obfuscated address which they can trivially correct themselves.