In ASP.Net/Core MVC, the auto-HTML escaping happens when you echo a string variable inside a Razor view. For example:
<div>@("<b>Hello</b>")</div>
is output as
<div><b>Hello</b></div>
How can I disable this feature by default in ASP.Net/Core MVC, without having to use a helper everywhere like Html.Raw(), WriteLiteral(), new HtmlString(), et cetera?
I understand the reasoning behind this functionality but I am experimenting with alternate escape methods.
答案 0 :(得分:1)
You can not disable it.
ASP.Net/Core MVC design for preventing Injection
(Web Application Security), the @ use frequently so it need prevent HTML
or Javascript
injection.