CODEWITHSUNDEEP
asp.net-mvc-3razor
Travis J
Travis J

Reputation: 82297

Is there a risk in using @Html.Raw?

Is there a risk in using @Html.Raw? It seems to me there shouldn't be. If there is a risk then wouldn't that risk already exist regardless of using @Html.Raw in that modern browsers such as Chrome will allow an edit injection of <script>malicious()</script> or even to change a form's post action to something else.

Upvotes: 6

Views: 8576

Answers (3)

user1446323
user1446323

Reputation:

If you are displaying user entered information it is better to use @Html.Encode().

In another words, if you are displaying non-user eneterd data you are safe to go with @Html.Raw()

Upvotes: 4

pollirrata
pollirrata

Reputation: 5286

@Html.Raw will allow executing any script that is on the value to display. If you want to prevent that you need to use @Html.AttributeEncode

Upvotes: 6

neontapir
neontapir

Reputation: 4736

Correct, the risk is in how it is used. There's no risk inherent in Html.Raw. It's a tool, nothing more.

Upvotes: 4

Related Questions