Is it possible to turn on HTML encoding by default in ASP.NET 4?

Question

In ASP.NET 4, we can use the new <%: ... %> operator to output HTML encoded strings. Is it possible to configure ASP.NET 4 (in web.config) so that the <%= ... %> operator will also HTML encode strings?

Answer 1

No, fortunately.

If you configure it this way, your developers will get into the habit of using <%= ... %> and not encoding.

If they subsequently work on a different (normal) project, they will end up forgetting to encode their output.

ASP.Net Razor does default to HTML encoding, because it doesn't have this issue.
(There is no Razor code you can switch to that won't encode by default)

Answer 2

Personally, I don't like this new <%: syntax. I rather use <%= HttpUtility.HtmlEncode( because it is much more explicit.

Besides this, it gives a false sense of security, because it only does HTML encoding. Look at this snippet for instance:

function myJavaScriptFunction()
{
    var message = '<%: Person.LastComment %>';
    alert(message);
}

It is not save, because it doesn't use the proper encoding. The following is safe:

function myJavaScriptFunction()
{
    var message = '<%: AntiXss.JavaScriptEncode(Person.LastComment) %>';
    alert(message);
}

Much more explicit.