c# - Avoiding script injection in input fields -

to avoid script injection via input fields, i'm setting validateinputattribute false in controller actions. , in views, i'm using <%: instead of <%=.

what want know, there more generic way in addition above?

to avoid script injection via input fields, i'm setting validateinputattribute false

this has contrary effect of trying achieve. allows script injection. when set false disable validation of request values.

and in views, i'm using <%: instead of <%=

that's correct way html encode data when displayed on view. of course if using html helpers (such html.displayfor or html.editorfor don't need use <%: because helpers take care of encoding output).