Do ASP.NET MVC helper methods like Html.DropDownList() encode the output HTML?

问题

I am just wondering if I have to worry about encoding the values that get output when I use HTML helpers like Html.DropDownList().

If so, how do I encode them? It's easy to do if I were building the drop down manually -- just wrap each value with "Html.Encode()". However, I don't know how to do this when using HTML helpers.

回答1:

It looks like the values are encoded automatically, so there's no reason to do it yourself. Here's a snippet from the actual ASP.NET MVC 1.0 source code that you can download from codeplex (in SelectExtensions.cs):

    private static string ListItemToOption(SelectListItem item) {
        TagBuilder builder = new TagBuilder("option") {
            InnerHtml = HttpUtility.HtmlEncode(item.Text)
        };
        if (item.Value != null) {
            builder.Attributes["value"] = item.Value;
        }
        if (item.Selected) {
            builder.Attributes["selected"] = "selected";
        }
        return builder.ToString(TagRenderMode.Normal);
    }

回答2:

They do.

If you want to do it yourself it's Html.Encode() and Html.AttributeEncode() depending on where in the HTML you're encoding.

来源：https://stackoverflow.com/questions/748557/do-asp-net-mvc-helper-methods-like-html-dropdownlist-encode-the-output-html