I’ve recently upgraded a client’s web site to .NET 4 and we’ve found out during the process that now GridView column values are automatically HTML encoded.
They have wide use of HTML strings in their code so we must turn that off. I know one solution would go over each column and add HtmlEncode=”false”. My question is – is there a way to set this to be the default for all GridView columns in this application?
Thanks!
I don’t think there is any way to do it by default as this was put in as a safety measure by default so that developers would need to consider turning it off.
To get around it you would need to turn it off column by column or you could inherit a new control from
GridViewand make it set each column be default to false. You could then just do a search and replace forGridViewwith your new control. I wouldn’t recommend this method though.Best would be to interrogate each column in the application and turn it off. It’s safer and it makes you actually consider where you want to open the door for the possibility of HTML / javascript injection. Better safe than sorry.