Html encoding TextboxFor input

Question

Please bare with my ignorance for now as I have just started learning web related programming. So, I have a web project written in MVC that has a login window with Username textbox bound to a property:

@Html.TextBoxFor(model => model.UserName, new {@placeholder = "Username"})

As I understand, Razor automatically html encodes input to help preventing cross-script attacks. However, when I test username with a javascript I get an exception from MVC:

A potentially dangerous Request.Form value was detected from the client (UserName="...hp?name_1=code

Which makes me think that the input is NOT html encoded. My idea was to resolve this issue with html encoding/decoding but looks like I am not getting this whole idea right. Could someone explain?

NOTE: one of SO's related posts provides an unsecured solution but it is not an option for me to simply allow html.

user1440815 · Accepted Answer · 2015-06-30 17:32:50Z

0

It is not HTML encoded, that is correct. You will have to do the HTML encoding in the Action that form posts back to.

Also, you will need to add [ValidateInput(false)] attribute just about your action.

answered Jun 30, 2015 at 17:32

user1440815

12 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Html encoding TextboxFor input

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related