Allow using some html tags in MVC 4

Question

How i can allow client to use html tags in MVC 4? I would like to save records to the database and when it extract in view allow only some HTML tags (< b > < i > < img >) and others tags must be represented as text.

My Controller:

    [ValidateInput(false)]
    [HttpPost]
    public ActionResult Rep(String a)
    {
            var dbreader = new DataBaseReader();
            var text = Request["report_text"];
            dbreader.SendReport(text, uid, secret).ToString();
           ...
    }

My View:

@{
    var dbreader = new DataBaseReader();
    var reports = dbreader.GetReports();
    foreach (var report in reports)
    {

           <div class="report_content">@Html.Raw(report.content)</div>
           ...

    }
}

I don't get what you want, can you add some further explanation? — Anarion
– Anarion, Commented Jan 13, 2014 at 11:12
No, I don't get error, but now my site vulnerable for XSS atacks — eLTG
– eLTG, Commented Jan 13, 2014 at 12:55

rkawano · Accepted Answer · 2014-01-13 11:45:00Z

1

You can replace all < chars to HTML entity:

tags = tags.Replace("<", "&lt;");

Now, replace back only allowed tags:

tags = tags
    .Replace("&lt;b>", "<b>")
    .Replace("&lt;/b>", "</b>")
    .Replace("&lt;i>", "</i>")
    .Replace("&lt;/i>", "</i>")
    .Replace("&lt;img ", "<img ");

And render to page using @Html.Raw(tags)

answered Jan 13, 2014 at 11:45

rkawano

2,52323 silver badges23 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Murali Murugesan · Accepted Answer · 2014-01-13 11:52:51Z

1

If you are trying some property of your view model object to accept Html text, use AllowHtmlAttribute

[AllowHtml]
public string UserComment{ get; set; }

and before binding to the view

model.UserComment=model.UserComment.Replace("<othertagstart/end>",""); //hard

edited Jan 13, 2014 at 11:52

answered Jan 13, 2014 at 11:44

Murali Murugesan

22.6k18 gold badges76 silver badges123 bronze badges

Comments

Marcin Wachulski · Accepted Answer · 2014-01-13 11:39:05Z

0

Turn off validation for report_text (1) and write custom HTML encoder (2):

Step 1:

Request.Unvalidated().Form["report_text"]

More info here. You don't need to turn off validation for entire controller action.

Step 2:

Write a custom html encoder (convert all tags except b, i, img to e.g.: script -> ;ltscript;gt), since you are customizing a default behaviour of request validation and html tag filtering. Consider to safeguard yourself from SQL injection attacks by checking SQL parameters passed to stored procedures/functions etc.

answered Jan 13, 2014 at 11:39

Marcin Wachulski

5774 silver badges14 bronze badges

Comments

Sander_P · Accepted Answer · 2014-01-13 11:55:33Z

0

You may want to check out BBCode BBCode on Wikipedia. This way you have some control on what is allowed and what's not, and prevent illegal usage.

This would work like this:

A user submits something like 'the meeting will now be on [b]monday![/b]'
Before saving it to your database you remove all real html tags ('< ... >') to avoid the use of illegal tags or code injection, but leave the pseudo tags as they are.
When viewed you convert only the allowed pseudo html tags into real html

answered Jan 13, 2014 at 11:55

Sander_P

1,8271 gold badge13 silver badges39 bronze badges

Comments

eLTG · Accepted Answer · 2014-01-14 20:08:57Z

0

I found solution of my problem:

            html = Regex.Replace(html, "&lt;b&gt;(.*?)&lt;/&gt;", "<b>$1</b>");
            html = Regex.Replace(html, "&lt;i&gt;(.*?)&lt;/i&gt;", "<i>$1</i>");
            html = Regex.Replace(html, "&lt;img(?:.*?)src=&quot;(.*?)&quot;(?:.*?)/&gt;", "<img src=\"$1\"/>");

answered Jan 14, 2014 at 20:08

eLTG

1891 silver badge13 bronze badges

Collectives™ on Stack Overflow

Allow using some html tags in MVC 4

5 Answers 5

Comments

Comments

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

Comments

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related