Output encoding
Output encoding or escaping is yet another defensive technique that helps neutralize injection attacks. This process replaces the characters in the untrusted data, which allows the application to display the output safely in its proper context.
In an ASP.NET Core web application, there's different contextual output that a developer should know about to understand the right encoder to use in a given context. These are HTML, HTML attribute context, CSS context, and JavaScript context.
By default, the Razor engine in ASP.NET Core automatically escapes output, apart from a few exceptions, where a method will disable such encoding. ASP.NET Core also provides a variety of encoders that we can use to explicitly implement proper contextual output.
In the next few recipes, we will learn how to perform output encoding with HtmlEncoder, UrlEncoder, and JavascriptEncoder.
