Microsoft Anti XSS Library encoding ampersands?

Question

I am currently using the Microsoft AntiXSS library and using the GetSafeHtmlFragment method as follows:

public static string SanitizeHtml(this string s)
{
    return Sanitizer.GetSafeHtmlFragment(s);
}

However, if I pass in a string like this:

black & white

... it is encoding the ampersand so it becomes:

black & white

Is this normal behaviour for this library? Is there a way of preventing it from encoding this character?

Answer 1

Is this normal behaviour for this library?

Yes, it fixes your HTML since you are using GetSafeHtmlFragment. Otherwise you would have ended up with invalid HTML fragment. In HTML the & character has special meaning. I don't think this behavior could be modified.