HtmlEncode on Post for ASP.Net MVC 3 Html.TextAreaFor

Question

I have an ASP.Net MVC 3 page in which I have an Html.TextAreaFor control, see code below. If I try to submit the page to the http post action with text in angle brackets like:

Answer 1

Basically right now, you're encoding the content of the TextAreaFor on the output. This doesn't help you in the slightest since you're trying to deal with input

If you want to submit "potentially dangerous" content, you need to either

1) decorate the RequestText property within your ViewModel with [AllowHtml]. (preferred)

[AllowHtml]
public string RequestText { get; set; }

2) disable validateRequest

Then you must ensure you're appropriately sanitizing that data and/or encoding it in your controller before submitting it to your Repository Layer or Database.