HTML escaping transforms text before it reaches a page, so characters such as markup delimiters appear as literal content instead of becoming HTML. Razor automatically HTML-encodes C# expressions, primarily to prevent users from injecting malicious data or JavaScript. section 17.3.3 section 29.1
Use HTML escaping as the safe default when writing values into Razor-rendered HTML:
- Render ordinary C# expressions with Razor’s default behavior; encoded tags such as <strong> remain visible as text. section 17.3.3
- Treat user-submitted names and other stored input as unsafe unless they are encoded when rendered. section 29.1
- Avoid Html.Raw for user input; it writes strings directly without encoding and can execute injected scripts. section 17.3.3 section 29.1
- When creating a Tag Helper, encode output before SetHtmlContent(), or pass unencoded input to SetContent() for automatic encoding. section 32.1.1
Displaying a task containing markup
Given task = "<strong>Check oil</strong>", ordinary Razor output produces visible text such as "<strong>Check oil</strong>" because the markup is encoded. Using @Html.Raw(task) instead produces bold text, but creates a security risk when the value is user-controlled. section 17.3.3
