MVC3 TextBoxFor with encoded text

Question

Is there a way to use TextBoxFor helper with encoded text?

for example: When using the following helper of MVC3 With Razor view engine :

@Html.TextBoxFor(model => model.Description)

and the value of model.Description is encoded, for example:

 &lt;script&gt;alert();&#39;&lt;/script&gt;

the result is text box with the the encoded string, when the wanted result is text box with the decoded string:

 <script>alert();'</script>

Is there a way to use the MVC TextBoxFor with encoded string instead of using

@Html.TextBox("Description", Server.HtmlDecode(Model.Description))

?

It looks to me like you might be over-encoding things somewhere. Why is the content encoded in the database? In general, it should not be: you should encode when displaying, in cases where you are protecting against injection. Encoding as you save and decoding when editing is fraught with errors and complications. — Andrew Barber
– Andrew Barber, Commented Dec 6, 2011 at 15:48
I thing that you are right, but it is good to know in cases that the data is saved to the database encoded. i'm guessing that the other method with @html.TextBox is the best solution for now. — Erann3
– Erann3, Commented Dec 7, 2011 at 7:40

dknaack · Accepted Answer · 2011-12-06 15:52:04Z

5

You have to html-decode your string.

Use the System.Web.HttpUtility.HtmlDecode for that.

System.Web.HttpUtility.HtmlDecode("&lt;script&gt;alert();&#39;&lt;/script&gt;")

will result in

<script>alert();'</script>

TextBoxFor does not support that so, you have 2 options

1. Decode before display

    @{
        Model.Description = System.Web.HttpUtility.HtmlDecode(Model.Description);
     }
    @Html.TextBoxFor(model => model.Description)

2. Use @Html.TextBox for this

    @Html.TextBox("Description", System.Web.HttpUtility.HtmlDecode(Model.Description))

hope this helps

edited Dec 6, 2011 at 15:52

answered Dec 6, 2011 at 15:23

dknaack

60.7k28 gold badges166 silver badges211 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Thank for the reply but the two option are not much different of what i suggested, probebly the closest solution for now.