Is there a risk in using @Html.Raw?

Question

Is there a risk in using @Html.Raw? It seems to me there shouldn\'t be. If there is a risk then wouldn\'t that risk already exist regardless of using @Htm

Answer 1

@Html.Raw will allow executing any script that is on the value to display. If you want to prevent that you need to use @Html.AttributeEncode

Answer 2

Correct, the risk is in how it is used. There's no risk inherent in Html.Raw. It's a tool, nothing more.

Answer 3

If you are displaying user entered information it is better to use @Html.Encode().

In another words, if you are displaying non-user eneterd data you are safe to go with @Html.Raw()