Output encoding using HtmlEncoder

HTML encoding converts special characters so that the browser will interpret the text correctly and not render it as HTML. For instance, a string may contain a less than character <, and in HTML standards, this is an HTML entity being used to open and close tags. This needs to be escaped into < to preserve the meaning of the text.

The protection that escaping output provides lies in preventing the attacker from changing the intent or the input's purpose when it is parsed by the interpreter. This stops the malicious actor from trying to execute scripts within the HTML context.

The following table displays the most common HTML entities and their encoded counterparts. This is by no means a complete list:

Table 1.1 – HTML entities

In this recipe, you will learn how to use HtmlEncoder to escape output in HTML.

Getting ready

Using Visual Studio Code, open the sample Online Banking app folder...