title: Encoding of HtmlControl.Attributes
body: <p>Does anybody knows if it is necessary to sanitize the contents of the HtmlControl.Attributes? MSDN is silent in that:</p>
  
  <p><a href="http://msdn.microsoft.com/en-us/library/system.web.ui.htmlcontrols.htmlcontrol.attributes.aspx" rel="nofollow noreferrer">http://msdn.microsoft.com/en-us/library/system.web.ui.htmlcontrols.htmlcontrol.attributes.aspx</a></p>
  
  <p>In other words, which of this is correct:</p>
  
  <pre><code>HtmlGenericControl control = new HtmlGenericControl();
  /*Option 1*/ control.Attributes["value"] = HttpUtility.HtmlAttributeEncode(unsafestring);
  /*Option 2*/ control.Attributes["value"] = unsafestring;
  </code></pre>