Do I need to html-encode title attributes (tooltips)?

Question

In my markup I am using HTML title attributes which I set by the Tooltip property of various ASP.NET controls like an asp:Label. The content of those titles come from a database and I use data binding syntax, for instance:

<asp:Label ID="PersonLabel" runat="server" 
    Text='<%# HttpUtility.HtmlEncode(Eval("PersonShortName")) %>'
    ToolTip='<%# HttpUtility.HtmlEncode(Eval("PersonFullName")) %>' />

Now, tooltips seem to be displayed as plain text on Windows and in the browsers I have tested. So the HTML-encoding is not what I really want and I am inclined to remove the encoding.

Can this be dangerous in any way if the database fields may contain script tags for example? My question is basically: Is it always guaranteed that HTML-title attributes are displayed as plain text? Are they always displayed as tooltips at all, or is it possible that some browsers (or OSs) display them in another way and allow and render HTML content in the title attributes?

Edit:

Looking at some of the answers it seems I didn't phrase my question well, so here are some additions:

If I have in the code snippet above a PersonShortName of "PM" in my database and as the PersonFullName a name with non-ASCII characters in it like Umlauts in "Peter Müller" the browser displays in the tooltip Peter Müller when I apply HttpUtility.HtmlEncode like in the code example - which is ugly.

I've also tested a simple HTML fragment like:

<span title="<script>alert('Evil script')</script>" >Hello</span>

The script in the title attribute didn't run in a browser with enabled Javascript (tested with Firefox), instead it was displayed in the tooltip as plain text. Therefore my guess was that title attributes are always rendered as plain text.

But as Felipe Alsacreations answered below there exist "rich tooltip plugins" which may render the title attribute as HTML. So in this case encoding is a good thing. But how can I know that?

Perhaps HttpUtility.HtmlEncode isn't the right solution and I have to filter only HTML tags but not encode simple special characters to make sure that the plain text is displayed correctly and to protect "rich HTML tooltips" at the same time. But it looks like a costly work - only for a simple tooltip.

Answer 1

Always sanitize output to the browser.

If a value like "><script>blabla</script> is inserted as a value for your fields, a user can essentially take over your entire site. It will probably make a mess when it comes to validation and correct code, but the script will still be run.

So to answer your question: No, it is not guaranteed that HTML-title attributes are displayed as plain text if the user knows what he/she is doing.

Answer 2

Beside security reasons:

Title attributes should always be plain text but certain JS plugins misuse them to display 'rich' tooltips (i.e. HTML code with bold text, emphasis, links and so on).

As for browsers and AFAIK they are displayed as plain text and tooltips, never displayed to those who use tabbed navigation (keyboard) and scren readers give to their users (blind and partially sighted people) many options, like reading the longest between link title and its text or always title or never ...

Answer 3

Another point:

Who cares how the title attribute is rendered by a browser, when it is the presence of malicious strings in the source code that could present an issue?

It doesn't matter how it is displayed, the question is: how does it appear in the source code?

(As already stated, if you're pumping strings to the client, do something to sanitize those strings.)