HTML tags inside the Database - YAY or NAY?

Question

I am using ASP.NET with C# and SQL Server 2005. I have a plane simple ASP.NET label on my form.

<asp:Label ID="lblBodyCopy1" runat="server"></asp:Label>

On Page load i populate this label with text that is saved in my database.

<p class="r_box_A">text text</p><p class="r_box_B">text text text</p>

Is this the right thing to do? If not what is then because i need to populate that label with text in such way that will have paragraphes and styles to each paragraph.

Thanks in advanced!

Answer 1

Generally, no. You want your DB fields to be independant of the medium they'll be used in (because there may be many: HTML, Plain Text, etc)

What you should do is reformat your fields to whatever context they are being displayed. This implies that if you need the data in a 'richer' format, you typically use a markup scheme (markdown, perhaps) so you can process it and render it in whatever fashion you like.

You may, however, cache this formatting in another field, to speed up the retrieval process.

Answer 2

You can have HTML code in your Label as well as your Literal. A Literal control is much more light weight than a Label.. it's meant to write out text/html directly to the browser. A Label is little bulkier than a Literal, but has all benefits of a WebControl such as styling options etc.

Literal Control : Asp.NET Literal

Answer 3

Who enters these strings to the database? The usual problem with this approach is that:

• you need to make sure that the resulting html is well formed
• it can be not secure if people include scripts in the html stored in the database, etc.

So in most cases you want to store only real text in the database, and then format it and escape all html chars when adding to the page.

Answer 4

I personally would avoid storing the HTML in the database... but then again it depends on the context.

If you have a table designed for storing input from a rich textbox then you will somehow need to store any formatting that has been applied.

As others have mentioned, prehaps a safer alternative would be to create your own [bbCode] syntax, pretty much similar to the way the textbox on here (Stack OverFlow) works...

eg. any text in bold 'foo' becomes [b]foo[/b]

There is added work involved because you will need to parse the text and replace any tags with the equivalent [bbCode] tags and then do the reverse when outputting to a web page, but I personally think it is a safer approach with regards to data integrity.

Answer 5

Why not store it as xhtml in the database - you can validate it before you push it in. use the XML field type. This way if your need to query on it you can, and you data is still structured.