Asp.net MVC Markdown editor and Html.Encode

Question

I might be mis-understanding here but from my understanding a markdown editor strips out all html.

After then using a markdown.Transform() type of method this database stored markdown is converted into html with h1, p etc.

With asp.net MVC the general rule is Html.Encode everything.

But does this still apply when using a Markdown editor seeing as Html.Encoding the Transformed markdown will render the generated html useless?

Chao · Accepted Answer · 2010-08-19 11:19:18Z

1

HTML.Encode everything is for potentially unsafe content, usually anything user inputted, if HTML is generated and the input can be trusted (ie run through something that strips the HTML, is run through the XSS library) then you can safely not encode it. To be more explicit you can return an MvcHtmlString rather than a string.

answered Aug 19, 2010 at 11:19

Chao

3,0433 gold badges33 silver badges36 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

asn1981 Over a year ago

yep makes sense, its what i thought and is pretty much common sense

Collectives™ on Stack Overflow

Asp.net MVC Markdown editor and Html.Encode

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related