asp.net C＃-替换文本或Web用户控件

Question

i'm developing a website allow user enter template for their content like this:

Name: ${name}
Email: ${email}
Phone: ${phone_number}
...

It was stored into database. When user invoke, engine get it out and replace all flags with fit contents:

tpl = tpl.Replace("${name}", customer.Name);
tpl = tpl.Replace("${email}", customer.Email);
...

I'm confusing about performance of this way. How about i convert a template to web user control (ascx file with out code behind) and load it when user invoke? I'm worry about this way too because one user can have many templates, so this will cause too much ascx files on server. Have anyone point me to the light :D? Thanks.

Answer 1

Don't worry about the performance. Be more concerned about XSS attacks.

Will HTML Encoding prevent all kinds of XSS attacks?

Answer 2

This is easy to do using a placeholder and regex. Check out my post to a similar question here:

Replace a string with a user control