how to show contents which include html tag?

Question

I am using FckEditor in Create.aspx page in asp.net mvc application.

Since I need to show rich text in web pages, I used ValidateInput(false) attribute top of action method in controller class.

And I used Html.Encode(Model.Message) in Details.aspx to protect user's attack.

But, I had result what I did not want as following :

<p> Hello </p>

I wanted following result not above :

Hello

How can I show the text what user input?

Thanks in advance

Answer 1

It seems the user entered "<p> Hello </p>" (due to pressing Enter?) into the edit control, and it is displaying correct in the HTML as you have done an Html.Encode. E.g. the paragrahs are not rendered, they are outputted as "<p>..</p>" as the string is HTML encoded into something like "<p> Hello <p>".

If you do not want tags, I would suggest searching the text string for tags (things with <...>) and removing them from the inputted text. Do this before HTML.Encode.

...or am I missing something?

Answer 2

You can use HttpServerUtility.HtmlEncode(String)

Answer 3

The short answer is that HTMLEncode is making your markup show like that. If you don't HTMLEncode, it will do what you want.

You need to think about whether or not you need full control of markup, who is entering the markup, and if an alternative like BBCode is an option.

If your users using the editor are all sure to be 'safe' users, then XSS isn't likely to be as much a concern. However, if you are using this on a comment field, then BBCode, or something like SO itself uses is more appropriate.

You wont be able to use a WYSIWYG editor and do HTMLEncode though... (without BBCode, or some other token system)