Saturday, January 8, 2011

ASP.NET 4.0- Html Encoded Expressions

We all know <%=expression%> features in We can print any string on page from there. Mostly we are using them in mvc. Now we have one new features with 4.0 that we have HTML Encoded Expressions and this prevent Cross scripting attack as we are html encoding them.

ASP.NET 4.0 introduces a new expression syntax <%: expression %> which automatically convert string into html encoded. Let’s take an example for that.

I have just created an hello word protected method which will return a simple string which contains characters that needed to be HTML Encoded. Below is code for that.

protected static string HelloWorld()
return "Hello World!!! returns from function()!!!>>>>>>>>>>>>>>>>>";
Now let’s use the that hello world in our page html like below. I am going to use both expression to give you exact difference.
<form id="form1" runat="server">
<strong><%: HelloWorld()%></strong>
<strong><%= HelloWorld()%></strong>

Now let’s run the application and you can see in browser both look similar.


But when look into page source html in browser like below you can clearly see one is HTML Encoded and another one is not.

HtmlEncodeView with html encoding

That’s it.. It’s cool.. Stay tuned for more.. Happy Programming
Technorati Tags: ,,
Shout it


Post a Comment

Your feedback is very important to me. Please provide your feedback via putting comments.

About Me
My Photo

Full Stack Developer,Blogger,Microsoft Mvp, Mentor, Life long learner, 10+ Years of Experience for JavaScript, web and Microsoft technologies. ASP.NET MVC,Web Forms,C#,AngularJs,Golang
Mvp profile
Subscribe to my blog

Enter your email address:

Follow us on facebook
Blog Archive
Total Pageviews