Search code examples
asp.netvb.netdata-bindingtwo-way-binding

Difference Between <%#..%> and <%#:..%>? (Colon Symbol)


I stumbled upon Microsoft ASP.NET's WingTipToy project where the line of code uses <%#: instead of <%#

What's the real main difference here?


Solution

  • From https://learn.microsoft.com/en-us/aspnet/web-forms/overview/getting-started/getting-started-with-aspnet-45-web-forms/ui_and_navigation

    By adding the (:) to the end of the <%# prefix, the result of the data-binding expression is HTML-encoded. When the result is HTML-encoded, your application is better protected against cross-site script injection (XSS) and HTML injection attacks