asp.net mvc标签：<％：％>与<％=％>

Question

As far as I can tell, both of these tag types do the same thing. Which is preferred to use?

Answer 1

It calls an HtmlEncode on the value

See ScottGu's blog for more info.

Answer 2

They are not the same:

<%=%> is the same as `Response.Write`
<%:%> adds `Server.HtmlEncode` to `Response.Write`

Hence, <%:%> is preferred (added since .NET 4.0), as it adds the security measure of encoding the output before outputting the string.

If you are using .NET 3.5 or before, best practice is to use <%=Server.HtmlEncode(val)%> .

Answer 3

<%: %>将是首选，因为它会自动对HTML进行编码，但它仅适用于.NET 4。

Answer 4

<%: someString %>

就好像

<%= HttpUtility.HtmlEncode(someString) %>

Answer 5

You use " <%:" when you need to sanitize the string (ie from something that was inputed by an user and can be potentially malicious)

Basically <&= just writes as string as it is to the HTML and <%: is the same as writing <%= Html.Encode("something") %>