I am making an application in MVC3, i am storing a string in database in this format
<a href='path'>Text</a> Happy
The field is saving properly but i have to display it in web page with hyper link like
Text Happy
but currently it is showing like
<a href='path'>Text</a> Happy
How can i render this string as HTML on web page?
If you're using the Razor template engine:
@Html.Raw(mystring)
If you are using Razor you can use @Html.Raw() as per Phil Haack's quick reference
its better you Encode HTML before storing it to database.. If you're using .Net Framework 4 try this
String TestString = "This is a <Test String>.";
String EncodedString = Server.HtmlEncode(TestString);
See msdn
Otherwise use anti xss library
Its workes like a magic and really easy to implement.. Un-Encoded is not only dangerous as it can cause XSS attacks but it also causes problems with rendering on html fornt page.
Hope it helps..
I would really advice against doing that because it's very hard to guard against script injection problems.
That being said though, if you think that can be managed, you should be able to use @Html.Raw to render the text without escaping.
If you are not using razor,
and string text = "<a href='path'>Text</a> Happy";
Then you want <%= text %>, not <%: text %>
As others have said, this is not considered great practice due to HTML injection, but it seems HTML injection is your intention.
