How to prevent escaping html in Razor (standalone)?

Question

I have a Model with property Content which contains HTML string.

var model = new { Content = ... }
Razor.Parse(templateBody, model)

How can I render this string using standalone Razor.

I tried:

@(new HtmlString(Model.Content))

and also

@(HttpUtility.HtmlDecode(Model.Content))

Model.Content renders always HTML-escaped.

Have you seen this SO answer? http://stackoverflow.com/a/4973743/195550 — scott-pascoe, Mar 07 '13 at 14:13
The `@(new HtmlString(Model.Content))` should do the trick... try it with: `@((IHtmlString)new HtmlString(Model.Content))` — nemesv, Mar 07 '13 at 14:13
possible duplicate of [Is it possible to display raw Html from database in ASP.NET MVC 3?](http://stackoverflow.com/questions/4798334/is-it-possible-to-display-raw-html-from-database-in-asp-net-mvc-3) — Michael Edenfield, Mar 08 '13 at 03:15
I don't have HtmlHelper and other web helpers outside web project. — Exta, Mar 09 '13 at 10:14

score 65 · Answer 1 · answered Mar 07 '13 at 17:26

65

this should work Html.Raw(Model.Content)

answered Mar 07 '13 at 17:26

Wahid Bitar

2

Simple and perfect! – Jacobson Dec 13 '18 at 13:48
this can lead to security problems like stored XSS and more – Ben.S Dec 20 '22 at 10:50

score 19 · Accepted Answer · answered Mar 11 '13 at 10:17

19

In RazorEngine library special "do-not-escape-me" type is RazorEngine.Text.IEncodedString. Use simple helper method on template base class:

 @Raw("<script>alert('!');</script>")

To convince VS and Resharper to give you IntelliSense add following line at the top of template:

@inherits RazorEngine.Templating.TemplateBase

answered Mar 11 '13 at 10:17

Artem Tikhomirov

2

That's really quite annoying that it doesn't use IHtmlString like one would expect. – rossisdead May 15 '13 at 18:56

2 Answers2