ASP.NET MVC: how to enable some HTML markup in HTML-encoded content?

Question

Is there any magical existing code in MVC 2 lines in Html.Encode () and allow certain HTML markup, like paragraph marks and breaks? (from the Linq to SQL field)

An example of terrible code to achieve an effect:

Html.Encode(Model.fieldName).Replace("&lt;br /&gt;", "<br />")

It would be very nice to overload something and pass it an array (or object) full of allowed html tags.

Answer 1

For ASP.NET or MVC there is nothing for this, but it is not so difficult to write your own whitelist with regular expressions and so on. Here is the one that Jeff wrote , although he is rather rude at the edges ...

Answer 2

, , , XSS.

"Pro ASP.NET MVC3 Framework": "... - : , ​​ HTML Agility Pack, , , ."

, XSS, , . http://ha.ckers.org/xss.html

Answer 3

I can’t think of anything right off the bat, but I think you could write an extension method that allows you to add a parameter / list of elements that can be resolved.

Html.Encode(Mode.fieldName, List<items> Myitems);

It can modify valid tags in <, etc., and then encodes the rest, as usual.