How do you avoid XSS vulnerabilities in ASP.Net (MVC)?

Question

I recently noticed that I had a big hole in my application because I had done something like:

\" />
         


        

Answer 1

Syntax for HTML encoding

1. <%: model.something %> syntax in WebForms

2. It is automatic in Razor i.e. @model.something will auto encode automatically no need to do anything to encode.

3. MVC3 HTML Helper methods return the encoded string automatically. e.g. Html.Label will return the encoded string

More about cross site scripting

http://thirum.wordpress.com/2013/10/24/how-asp-net-mvc-prevents-cross-site-scriptingxss-attack/