HTML Encoding

  • 8 minutes to read

A website's rendered output should be HTML encoded within a page to protect it from cross-site scripting (XSS) attacks. This means that a page's HTML content should not contain potentially unsafe tags like <script> or <img> (for example, <img onload=...>).

Use the EncodeHtml property to HTML encode a DevExpress web control's value and element content. If the control's EncodeHtml property is set to true, the control's value and element content that contain HTML code are parsed. HTML tags' angle bracket (the characters < and >) are converted to specific symbols (&lt; and &gt;) when the control renders its value and elements to the page. This allows displaying the HTML code on the page as text. Note that the EncodeHtml property doesn't encode the control's value and elements specified on the client side.

Use the following links to navigate to the tables that provide information for which DevExpress control elements the corresponding EncodeHtml properties are in effect:

ASPxGridView, ASPxCardView, ASPxVerticalGrid, ASPxTreeList and ASPxFilterControl controls do not provide the EncodeHtml property. Use the following properties to encode data in these controls:

  • A column's EncodeHtml property allows you to HTML encode data columns' field values.

  • The EncodeErrorHtml property specifies whether a grid renders its error texts as HTML or as text (removes HTML tags).

ASPxWebControl.EncodeHtml Property

DevExpress Web Control

Web control's element(s) for which the ASPxWebControl.EncodeHtml property is in effect

Notes

ASPxBinaryImage

ASPxEditBase.Caption

CaptionSettings.RequiredMark (EditorCaptionSettings.RequiredMark)

CaptionSettings.OptionalMark (EditorCaptionSettings.OptionalMark)

ASPxButton

ASPxButton.Text

ASPxCaptcha

CaptchaValidationSettings.ErrorText

ValidationSettings.RequiredField.ErrorText (ValidationPattern.ErrorText)

RefreshButtonProperties.Text

CaptchaTextBoxProperties.LabelText

If the ASPxWebControl.EncodeHtml property is false, the control's null text (CaptchaTextBoxProperties.NullText) is not executed. It is converted into the corresponding text for display purposes.

ASPxCloudControl

Items[i].Text (CloudControlItem.Text)

The ASPxWebControl.EncodeHtml property is not in effect for the ASPxCloudControl.ItemBeginText and ASPxCloudControl.ItemEndText properties. These properties' values are not HTML encoded and are rendered as pure HTML markup.

ASPxDataView

ASPxPager's buttons texts

The ASPxWebControl.EncodeHtml property is not in effect for the ASPxDataView's item content. Encode the template HTML using the HttpUtility.HtmlEncode method as the item content is defined using templates.


<ItemTemplate>
    <b>CategoryID</b>:
        <asp:Label ID="CategoryIDLabel" runat="server" Text='<%# System.Web.HttpUtility.HtmlEncode(Eval("CategoryID")) %>' />
</ItemTemplate>

The ASPxWebControl.EncodeHtml property is not in effect for the DataViewPagerSettings.ShowMoreItemsText and ASPxDataViewBase.EmptyDataText properties. These properties' values are not HTML encoded and are rendered as pure HTML markup.

ASPxPager

AllButton.Text (PagerButtonProperties.Text)

FirstPageButton.Text (PagerButtonProperties.Text)

LastPageButton.Text (PagerButtonProperties.Text)

NextPageButton.Text (PagerButtonProperties.Text)

PrevPageButton.Text (PagerButtonProperties.Text)

The ASPxWebControl.EncodeHtml property is not in effect for the page size item's caption (PageSizeItemSettings.Caption). This property value is not HTML encoded and is rendered as pure HTML markup.

ASPxHeadline

ASPxHeadline.ContentText

ASPxHeadline.HeaderText

The ASPxWebControl.EncodeHtml property is not in effect for the control's tail text (ASPxHeadline.TailText). This property value is not HTML encoded and is rendered as pure HTML markup.

The ASPxHeadline.MaxLength and ASPxHeadline.TailPosition (that is set to KeepWithLastWord) properties are not in effect if the ASPxWebControl.EncodeHtml property is set to false.

ASPxHint

ASPxHint.Content

ASPxHint.Title

The ASPxWebControl.EncodeHtml property is not in effect for the hint's content specified on the client side.

ASPxHtmlEditor

ContextMenuItems[i].Text (HtmlEditorContextMenuItem.Text)

ValidationSettings.ErrorText

ValidationSettings.RequiredField.ErrorText (ValidationPattern.ErrorText)

The ASPxWebControl.EncodeHtml is not in effect for the ToolbarItemPickerItem.Text and ToolbarItemPickerItem.Value.

ASPxImageGallery

Items[i].Text (ImageGalleryItem.Text)

Items[i].FullScreenViewerText (ImageGalleryItem.FullscreenViewerText)

The ASPxWebControl.EncodeHtml property is not in effect for the ASPxDataViewBase.EmptyDataText and ImageGalleryPagerSettings.ShowMoreItemsText properties. These properties' values are not HTML encoded and are rendered as pure HTML markup.

ASPxImageSlider

Items[i].Text (ImageSliderItem.Text)

ASPxMenu

Items[i].Text (MenuItem.Text)

ASPxNavBar

Groups[i].Text (NavBarGroup.Text)

Groups[i].Items[i].Text (NavBarItem.Text)

ASPxNewsControl

Items[i].HeaderText (NewsItem.HeaderText)

Items[i].Text (NewsItem.Text)

ASPxPager's buttons texts

The ASPxWebControl.EncodeHtml property is not in effect for the HeadlineSettings.TailText and ASPxDataViewBase.EmptyDataText properties. These properties' values are not HTML encoded and are rendered as pure HTML markup.

The ItemSettings.MaxLength (ASPxHeadline.MaxLength) and ItemSettings.TailPosition (HeadlineSettings.TailPosition that is set to KeepWithLastWord) properties are not in effect if the ASPxWebControl.EncodeHtml property is set to false.

ASPxPageControl

TabPages[i].Text (TabBase.Text)

ASPxPopupMenu

Items[i].Text (MenuItem.Text)

ASPxPopupControl

ASPxPopupControlBase.HeaderText

ASPxPopupControlBase.FooterText

ASPxPopupControlBase.Text

ASPxRibbon

Tabs[i].Text (RibbonTab.Text)

Tabs[i].Groups[i].Text (RibbonGroup.Text)

Tabs[i].Groups[i].Items[i].Text (RibbonItemBase.Text)

ASPxRichEdit

Elements of the ribbon and popup control

ASPxRoundPanel

ASPxWebControl.EncodeHtml

The ASPxWebControl.EncodeHtml property is not in effect for the ASPxRoundPanel.HeaderText property. This property value is not HTML encoded and is rendered as pure HTML markup.

ASPxSpreadsheet

Elements of the ribbon and popup control

The control's content is encoded

ASPxTabControl

Tabs[i].Text (TabBase.Text)

ASPxTitleIndex

Items[i].Text (TitleIndexItem.Text)

The ASPxWebControl.EncodeHtml property is not in effect for the ASPxTitleIndex.NoDataText, FilterBox.Caption and FilterBox.InfoText properties. These properties' values are not HTML encoded and are rendered as pure HTML markup.

ASPxTreeView

Nodes[i].Text (TreeViewNode.Text)

ASPxUploadControl

AddButton.Text (UploadControlButtonPropertiesBase.Text)

UploadButton.Text (UploadControlButtonPropertiesBase.Text)

RemoveButton.Text (UploadControlButtonPropertiesBase.Text)

BrowseButton.Text (UploadControlButtonPropertiesBase.Text)

CancelButton.Text (UploadControlButtonPropertiesBase.Text)

ASPxValidationSummary

ASPxValidationSummary.HeaderText

Set the EncodeHtml property to true of the corresponding editor to encode an error text within the ASPxValidationSummary.

EditPropertiesBase.EncodeHtml Property

DevExpress Web Control

Editor's element(s) for which the EditPropertiesBase.EncodeHtml property is in effect

Notes

ASPxCalendar

ASPxCalendar.ClearButtonText

ASPxCalendar.TodayButtonText

CalendarFastNavProperties.CancelButtonText

CalendarFastNavProperties.OkButtonText

ValidationSettings.ErrorText

ASPxCheckBox

ASPxCheckBox.Text

ValidationSettings.ErrorText

ValidationSettings.RequiredField.ErrorText (ValidationPattern.ErrorText)

ASPxCheckBoxList

Items[i].Text (ListEditItem.Text)

Items[i].Value (ListEditItem.Value)

ValidationSettings.ErrorText

ValidationSettings.RequiredField.ErrorText (ValidationPattern.ErrorText)

ASPxColorEdit

buttons[i].Text (EditButton.Text)

ASPxEditBase.Caption

ASPxTextEdit.HelpText

DropDownButton.Text (EditButton.Text)

ClearButtonText.Text (EditButton.Text)

If the EditPropertiesBase.EncodeHtml property is set to false, the color editor's value (ASPxColorEdit.Value), null text (ASPxColorEdit.NullText) and OK/Cancel buttons (ASPxColorEdit.CancelButtonText/ASPxColorEdit.OkButtonText) are not executed and are converted into the corresponding text for display purposes.

ASPxComboBox

Items[i].Text (ListEditItem.Text)

Buttons[i].Text (EditButton.Text)

ASPxTextEdit.HelpText

DropDownButton.Text (EditButton.Text)

ClearButton.Text (EditButton.Text)

ValidationSettings.ErrorText

ValidationSettings.RequiredField.ErrorText (ValidationPattern.ErrorText)

CaptionSettings.RequiredMark (EditorCaptionSettings.RequiredMark)

CaptionSettings.OptionalMark (EditorCaptionSettings.OptionalMark)

If the EditPropertiesBase.EncodeHtml property is set to false, the editor's null text (ASPxAutoCompleteBoxBase.NullText) is not executed and is converted into the corresponding text for display purposes.

We recommended to use the editor's Item Template, and ItemTextCellPrepared and ItemRowPrepared events instead of the EditPropertiesBase.EncodeHtml property for better security. Use the HttpUtility.HtmlEncode method to encode the template's content.

ASPxDateEdit

ASPxEditBase.Caption

ASPxTextEdit.HelpText

Buttons[i].Text (EditButton.Text)

DropDownButton.Text (EditButton.Text)

ClearButton.Text (EditButton.Text)

ValidationSettings.ErrorText

ValidationSettings.RequiredField.ErrorText (ValidationPattern.ErrorText)

CaptionSettings.RequiredMark (EditorCaptionSettings.RequiredMark)

CaptionSettings.OptionalMark (EditorCaptionSettings.OptionalMark)

CalendarProperties.ClearButtonText

CalendarProperties.TodayButtonText

DateEditTimeSectionProperties.OkButtonText

DateEditTimeSectionProperties.CancelButtonText

DateEditTimeSectionProperties.CancelButtonText

CalendarFastNavProperties.OkButtonText

If the EditPropertiesBase.EncodeHtml property is set to false, the editor's null text (ASPxDateEdit.NullText) is not executed and is converted into the corresponding text for display purposes.

ASPxDropDownEdit

ASPxEditBase.Caption

ASPxTextEdit.HelpText

Buttons[i].Text (EditButton.Text)

DropDownButton.Text (EditButton.Text)

ClearButton.Text (EditButton.Text)

ValidationSettings.ErrorText

ValidationSettings.RequiredField.ErrorText (ValidationPattern.ErrorText)

CaptionSettings.RequiredMark (EditorCaptionSettings.RequiredMark)

CaptionSettings.OptionalMark (EditorCaptionSettings.OptionalMark)

If the EditPropertiesBase.EncodeHtml property is set to false, the editor's value (ASPxTextEdit.Text) and null text (ASPxDropDownEdit.NullText) are not executed and are converted into the corresponding texts for display purposes.

ASPxHyperLink

ASPxHyperLink.Text

ASPxLabel

ASPxLabel.Text

ASPxListBox

Items[i].Text (ListEditItem.Text)

Items[i].Value (ListEditItem.Value)

ASPxEditBase.Caption

ValidationSettings.ErrorText

ValidationSettings.RequiredField.ErrorText (ValidationPattern.ErrorText)

CaptionSettings.RequiredMark (EditorCaptionSettings.RequiredMark)

CaptionSettings.OptionalMark (EditorCaptionSettings.OptionalMark)

We recommended to use the editor's Item Template, and ItemTextCellPrepared and ItemRowPrepared events instead of the EditPropertiesBase.EncodeHtml property for better security. Use the HttpUtility.HtmlEncode method to encode the template's content.

ASPxRadioButton

ASPxCheckBox.Text

ValidationSettings.ErrorText

ValidationSettings.RequiredField.ErrorText (ValidationPattern.ErrorText)

ASPxRadioButtonList

Items[i].Text (ListEditItem.Text)

Items[i].Value (ListEditItem.Value)

ValidationSettings.ErrorText

ValidationSettings.RequiredField.ErrorText (ValidationPattern.ErrorText)

CaptionSettings.RequiredMark (EditorCaptionSettings.RequiredMark)

CaptionSettings.OptionalMark (EditorCaptionSettings.OptionalMark)

ASPxSpinEdit

ASPxSpinEdit.Value

ASPxEditBase.Caption

ASPxTextEdit.HelpText

Buttons[i].Text (EditButton.Text)

ClearButton.Text (EditButton.Text)

ValidationSettings.ErrorText

ValidationSettings.RequiredField.ErrorText (ValidationPattern.ErrorText)

CaptionSettings.RequiredMark (EditorCaptionSettings.RequiredMark)

CaptionSettings.OptionalMark (EditorCaptionSettings.OptionalMark)

If the EditPropertiesBase.EncodeHtml property is set to false, the editor's null text (ASPxSpinEdit.NullText) is not executed and is converted into the corresponding text for display purposes.

ASPxTimeEdit

ASPxEditBase.Caption

ASPxTextEdit.HelpText

Buttons[i].Text (EditButton.Text)

ClearButton.Text (EditButton.Text)

ValidationSettings.ErrorText

ValidationSettings.RequiredField.ErrorText (ValidationPattern.ErrorText)

CaptionSettings.RequiredMark (EditorCaptionSettings.RequiredMark)

CaptionSettings.OptionalMark (EditorCaptionSettings.OptionalMark)

If the EditPropertiesBase.EncodeHtml property is set to false, the editor's value (ASPxTimeEdit.Value) and null text (ASPxTimeEdit.NullText) are not executed and are converted into the corresponding texts for display purposes.

ASPxTokenBox

ASPxTokenBox.Tokens

ListEditItem.Text

ListEditItem.Value

ASPxEditBase.Caption

ASPxTextEdit.HelpText+

If the EditPropertiesBase.EncodeHtml property is set to false, the editor's null text (ASPxTextBox.NullText) is not executed and is converted into the corresponding text for display purposes.

We recommended to use the editor's Item Template, and ItemTextCellPrepared and ItemRowPrepared events instead of the EditPropertiesBase.EncodeHtml property for better security. Use the HttpUtility.HtmlEncode method to encode the template's content.

ASPxMemo.EncodeHtml Property

DevExpress Web Control

Web control's element(s) for which the ASPxMemo.EncodeHtml property is in effect

Notes

ASPxMemo

ASPxEditBase.Caption

ASPxTextEdit.HelpText

CaptionSettings.RequiredMark (EditorCaptionSettings.RequiredMark)

CaptionSettings.OptionalMark (EditorCaptionSettings.OptionalMark)

ValidationSettings.ErrorText

ValidationSettings.RequiredField.ErrorText (ValidationPattern.ErrorText)

If the ASPxMemo.EncodeHtml property is set to false, the editor's value (ASPxMemo.Text) and null text (ASPxMemo.NullText) are not executed and are converted into the corresponding texts for display purposes.

ASPxFormLayout.EncodeHtml Property

DevExpress Web Control Web control's element(s) for which the ASPxFormLayout.EncodeHtml property is in effect
ASPxFormLayout Items[i].Caption (LayoutItemBase.Caption)

ASPxPivotGrid.EncodeHtml Property

DevExpress Web Control

Web control's element(s) for which the ASPxPivotGrid.EncodeHtml property is in effect

ASPxPivotGrid

Cell values and column/row field values.

Pager's buttons texts (for more information, see for which elements of a pager the EncodeHtml property is in effect).

ASPxTextBoxBase.EncodeHtml Property

DevExpress Web Control

Editor's element(s) for which the ASPxTextBoxBase.EncodeHtml property is in effect

Notes

ASPxButtonEdit

ASPxEditBase.Caption

ValidationSettings.ErrorText

ASPxTextEdit.HelpText

Buttons[i].Text (EditButton.Text)

If the ASPxTextBoxBase.EncodeHtml property is set to false, the button edit editor's value (ASPxTextEdit.Text) and null text (ASPxButtonEdit.NullText) are not executed and are converted into the corresponding texts for display purposes.

ASPxTextBox

ASPxEditBase.Caption

ValidationSettings.ErrorText

ASPxTextEdit.HelpText

If the ASPxTextBoxBase.EncodeHtml property is set to false, the text box editor's value (ASPxTextEdit.Text) and null text (ASPxTextBox.NullText) are not executed and are converted into the corresponding texts for display purposes.

ASPxTrackBar.EncodeHtml Property

DevExpress Web Control

Web control's element(s) for which the EncodeHtml property is in effect

ASPxTrackBar

Item and tooltip texts.