Search code examples
asp.net.net-4.0asp.net-4.0html-encode

Is it possible to turn on HTML encoding by default in ASP.NET 4?

In ASP.NET 4, we can use the new <%: ... %> operator to output HTML encoded strings. Is it possible to configure ASP.NET 4 (in web.config) so that the <%= ... %> operator will also HTML encode strings?

Solution

  • No, fortunately.

    If you configure it this way, your developers will get into the habit of using <%= ... %> and not encoding.

    If they subsequently work on a different (normal) project, they will end up forgetting to encode their output.

    ASP.Net Razor does default to HTML encoding, because it doesn't have this issue.
    (There is no Razor code you can switch to that won't encode by default)