The views engine in ASP.NET Core uses HTML encoders to render HTML, in an effort to prevent script injection attacks. The RazorPage class, the base for all Razor views, features an HtmlEncoder property of HtmlEncoder type. By default, it is obtained from DI as DefaultHtmlEncoder , but you can set it to a different instance, although it is probably not needed. We ask for content to be encoded explicitly by using the @("...") Razor syntax, like this:
@("<div>encoded string</div>")
This will render the following HTML-encoded string:
<div>encoded string</div>
You can also explicitly do it using the Encode method of the IHtmHelper object, like this:
@Html.Encode("<div>encoded string</div>")
Lastly, if you have a helper method that returns a value of IHtmlContent, it will automatically be rendered using the registered HtmlEncoder.
...
