Should I html encode values in an input field?

Question

Which should I use?

<input type="hidden" name="first_name" 
value="<%= person.first_name %>" />

or

<input type="hidden" name="first_name" 
value="<%= Html.Encode( person.first_name ) %>" />

Answer 1

You should Html.Encode else a " in the field could lead to injection problems

Answer 2

If you want to set a default value for an HTML element, you have to encode the HTML special characters inside the value using character references.