Asp.net MVC Markdown editor and Html.Encode

Question

I might be mis-understanding here but from my understanding a markdown editor strips out all html.

After then using a markdown.Transform() type of method this database stored markdown is converted into html with h1, p etc.

With asp.net MVC the general rule is Html.Encode everything.

But does this still apply when using a Markdown editor seeing as Html.Encoding the Transformed markdown will render the generated html useless?

Answer 1

HTML.Encode everything is for potentially unsafe content, usually anything user inputted, if HTML is generated and the input can be trusted (ie run through something that strips the HTML, is run through the XSS library) then you can safely not encode it. To be more explicit you can return an MvcHtmlString rather than a string.