asp.net-mvcsql-injectionhtml.encode

Does Html.LabelFor or Html.TextBoxFor automatically call Html.Encode?

do I still need to call html.ecnode even if I'm only using Html.LabelFor and Html.TextBoxFor or similar function and not using the text directly?

Solution

  • if you calling html.textboxfor and htmp.textbox in (mvc2)

            <%: Html.TextBoxFor(x=> x.MyName) %>

    then no need to call html.encode.

    : in <%: is a html.encode

    SO Question for more details