Practical .NET

Accept HTML and Script from Your Web Pages

Accept HTML and Script from Your Web Pages

By default, ASP.NET prevents users from entering HTML and Script into your page's textboxes. You can turn that off if you want (and, potentially, open your site to various hacks), but you'll have to decide how much exposure you want.

You can turn off checking for HTML on a property-by-property basis by decorating properties in your Model object (SampleInput, in my example), with the AllowHtml attribute. This turns off validation for elements generated from the FormattedText property:

Public Class SampleInput
  Public Property FormattedText As String

Alternatively, you can decorate your Action method with the ValidateInput attribute, passing False, to turn off validation for the whole Action method:

Function Index(cust As SampleInput) As ActionResult

The smarter move is probably to just turn off validation for the properties involved.

Be warned: It doesn't take much to confuse this process. I've discovered that having another element on the page that uses (for example) the Remote attribute defeats both AllowHtml and ValidateInput.

You'll also want to examine the data returned to your Action method to make sure that it only contains HTML that you're willing to accept (probably formatting tags like <em> or <i>) and doesn't contain tags you don't want (for example, <link> or <script<). The safest solution is probably to count all the tags in your input (such as count all the </ or /> strings) and then count the number of "acceptable" tags (the number <em and <i strings). If the two numbers are different, reject the input.

About the Author

Peter Vogel is a system architect and principal in PH&V Information Services. PH&V provides full-stack consulting from UX design through object modeling to database design. Peter tweets about his VSM columns with the hashtag #vogelarticles. His blog posts on user experience design can be found at

comments powered by Disqus


  • Microsoft's Tools to Fight Solorigate Attack Are Now Open Source

    Microsoft open sourced homegrown tools it used to check its systems for code related to the recent massive breach of supply chains that the company has named Solorigate.

  • Microsoft's Lander on Blazor Desktop: 'I Don't See a Grand Unified App Model in the Future'

    For all of the talk of unifying the disparate ecosystem of Microsoft-centric developer tooling -- using one framework for apps of all types on all platforms -- Blazor Desktop is not the answer. There isn't one.

  • Firm Automates Legacy Web Forms-to-ASP.NET Core Conversions

    Migration technology uses the Angular web framework and Progress Kendo UI user interface elements to convert ASP.NET Web Forms client code to HTML and CSS, with application business logic converted automatically to ASP.NET Core.

  • New TypeScript 4.2 Tweaks Include Project Explainer

    Microsoft shipped TypeScript 4.2 -- the regular quarterly update to the open source programming language that improves JavaScript with static types -- with a host of tweaks including a way to explain why files are included in a project.

Upcoming Events