Tip: Replacing Html.Encode Calls With New Html Encoding Syntax

Like the well disciplined secure developer that you are, when you built your ASP.NET MVC 1.0 application, you remembered to call Html.Encode every time you output a value that came from user input. Didn't you? Well, in ASP.NET MVC 2 running on ASP.NET 4, those calls can be replaced with the new HTML encoding syntax (aka code nugget). I've written a three part series on the topic. Html Encoding Code Blocks With ASP.NET 4 Html Encoding Nuggets With ASP.NET MVC 2 Using AntiXss as the default encoder for ASP.NET But dang, going through all your source files cleaning up these calls is a pretty big pain. Don't worry, I have your back. Just bring up the Find an Replace dialog ( CTRL + SHIFT + H ) and expand the Find options section and check the checkbox...(read more) ...