Why does a Label control *not* UrlEncode its Text?

[Kevin Frey]

Can anyone tell me the logical reason for the above. I've read the
documentation and made note of the fact that the Label might be used to
display user input, which might be malicious script etc, but I'd like to
know why the content isn't UrlEncoded for a Label control?

If one wants unencoded strings, shouldn't one be using LiteralControl
instead?

 

[Kevin Frey]

Correction. I meant HtmlEncode.

 

[john smith]

Correction. I meant HtmlEncode.

Short answer, the ASP.NET tags render as normal HTML controls (that your
web browser understands hence displays). These controls (text, textarea,
etc) pass plain text (it's the browser's behavior). It's been like that
since day 1. I don't see why they should/would HtmlEncode the text
either (and when you need it to, it's just a short string).

 

[Patrice]

Broadest feature. As it is rendered it is legal to assingn HTML code to a
label. Encoding would have prevent to do something that is legal and would
have forced to use another soltuion.

As a side note, ASP..NET prevents to submit HTML tags in form fields by
default...