ASP.NET MVC 2 and CKEditor input validation

Question

I need to configure both mvc and ckeditor to work properly with validation. At first, I got an error about the Form.Request is dangerous because it contained html elements. I changed that, now my output in mvc is not correct. Here is my code:

CKeditor config:

config.htmlEncodeOutput = true;

ASP.NET Textarea:

 <%: Html.TextAreaFor(model => Model.Description)%>
 <script type="text/javascript">
     CKEDITOR.replace('Description');
 </script>

Output in the same CKEditor when on the edit page:

<p> <strong>this is bold</strong></p>

ASP.NET display:

<%: Model.Description %>

Output:

<p> <strong>this is bold</strong></p>

How do I fix this? I want these tags to show properly in both the display and editor without allowing XSS.

Answer 1

<%: Model.Description %> uses HTML encode to display the description. You could use <%= Model.Description %> if you don't want to encode but this is vulnerable to XSS.