Issue with <%: ... %> vs. <%= %> when displaying generated text

Question

Hello SO:

I am writing an MVC application with C#. In this one particular section, I have a conditional switch for the navigation to highlight the appropriate tab. Here is the code for that:

<script type="text/C#" runat="server">
    string oController;
    string oAction;
    const string current = "class=\"current_page\"";

    protected override void OnLoad(EventArgs e)
    {
        oController = ViewContext.RouteData.Values["controller"].ToString();
        oAction = ViewContext.RouteData.Values["action"].ToString();

        base.OnLoad(e);
    }
</script>

<div id="menu">
    <ul>
        <li <%= (oController.Equals("Home") ? current : "") %>><a href="/">Home</a></li>
        <li><a href="/CustomerManager/">Customer Manager</a></li>
        <!-- <%: oController.Equals("Home") %> -->
        <!-- <%: oAction %> -->
    </ul>
</div>

On this line (<li <%= (oController.Equals("Home") ? current : "") %>><a href="/">Home</a></li>) if I use the <%: %> ASP nugget instead of <%= %> (as is recommended, since the latter is being phased out soon), the generated text comes out as

<li class=&quot;current_page&quot;><a href="/">Home</a></li> 

Instead of

<li class="current_page"><a href="/">Home</a></li>

Any suggestions and/or reasons why this is happening? Thanks!

Answer 1

Because <%: is intended to encode data such as user input. In your case, that is self-generated (trusted) html, so you don't want to encode it; <%= is the correct usage.

<%: is for things like <%:user.Name%>, which conveniently prevents issues for malicious text with xss etc in it.

Answer 2

You could just have the class be empty when the value is not Home. Clearly you are trying to omit it all together, but it would be a solution none the less.

const string current = "current_page";
<li class="<%: (oController.Equals("Home") ? current : "") %>"><a href="/">Home</a></li>