HTML not encoded in view:
Razor:
@Html.Raw(Model.SomeHtmlStringComingFromTheDatabase)
WebForms:
<%= Model.SomeHtmlStringComingFromTheDatabase %>
Note: by doing this, you acknowledge that you fully understand the consequences of XSS attacks , that your application becomes vulnerable, and that you are doing the necessary to sanitize this HTML if it comes from user input.
source
share