Question

Is there anyway to let users write their own aspx templates with my defined dynamic variables? Note that I don’t want to use Web Forms (so there are no tags like <asp:button> etc).

In addition, I’d need a security solution so users can’t change the system or do dangerous things like this.

Thanks.

Answer 1

Personally I would avoid using the ASPX engine for this. I would probably use either a really simple custom formatting solution (such as just a text file with %%VAR_NAME%% allowed for dynamic values), or I would look at a templating language such as Markdown (used by StackOverflow and others). BBCode is another option in a similar vein.

Allowing people to create ASPX templated pages on the fly seems like to much of a security issue to me. It would be hard to make sure you have closed all the possible attack vectors once they have direct access to the ASP.NET engine.

Since you didn’t specify, I’m just guessing at your needs, so depending on the exact problem this may or may not be your best bet. If you include more details about the problem you are solving it would be easier to make suggestions.