title: Prevent XSS attacks and still use Html.Raw
body: <p>I have CMS system where I am using CK Editor to enter data. Now if user types in <code>&lt;script&gt;alert('This is a bad script, data');&lt;/script&gt;</code> then CKEditor does the fair job and encodes it correctly and passes <code>&amp;lt;script&amp;gt;alert(&amp;#39;This is a bad script, data&amp;#39;)&amp;lt;/script&amp;gt;</code> to server. </p>
  
  <p>But if user goes into browser developer tools (using Inspect element) and adds this inside it as shown in the below screen shot then this is when all the trouble starts. Now after retrieving back from DB when this is displayed in Browser it presents alert box.</p>
  
  <p><img src="https://i.stack.imgur.com/1Cpa9.png" alt="Edit CKEditor contents thru inspect element"></p>
  
  <p>So far I have tried many different things one them is </p>
  
  <ul>
  <li>Encode the contents using <a href="https://msdn.microsoft.com/en-us/library/system.web.security.antixss.antixssencoder(v=vs.110).aspx" rel="noreferrer">AntiXssEncoder</a> [<code>HttpUtility.HtmlEncode(Contents)</code>] and then store it in database and when displaying back in browser decode it and display it using MvcHtmlString.Create [<code>MvcHtmlString.Create(HttpUtility.HtmlDecode(Contents))</code>] or Html.Raw [<code>Html.Raw(Contents)</code>] as you may expect both of them displays JavaScript alert.</li>
  </ul>
  
  <p>I don't want to replace the <code>&lt;script&gt;</code> manually thru code as it is <a href="http://www.troyhunt.com/2010/05/owasp-top-10-for-net-developers-part-2.html" rel="noreferrer">not comprehensive solution</a> (search for "And the encoded state:").</p>
  
  <p>So far I have referred many articles (sorry not listing them all here but just adding few as proof to show I have put sincere efforts before writing this question) but none of them have code which shows the answer. May be there is some easy answer and I am not looking in right direction or may be it is not that simple at all and I may need to use something like <a href="http://blog.simontimms.com/2013/01/21/content-security-policy-for-asp-net-mvc/" rel="noreferrer">Content Security Policy</a>.</p>
  
  <p><a href="https://stackoverflow.com/questions/29712687/asp-net-mvc-html-raw-with-antixss-protection">ASP.Net MVC Html.Raw with AntiXSS protection</a>
  <a href="https://stackoverflow.com/questions/11144943/is-there-a-risk-in-using-html-raw">Is there a risk in using @Html.Raw?</a>
  <a href="http://blog.simontimms.com/2013/01/21/content-security-policy-for-asp-net-mvc/" rel="noreferrer">http://blog.simontimms.com/2013/01/21/content-security-policy-for-asp-net-mvc/</a>
  <a href="http://blog.michaelckennedy.net/2012/10/15/understanding-text-encoding-in-asp-net-mvc/" rel="noreferrer">http://blog.michaelckennedy.net/2012/10/15/understanding-text-encoding-in-asp-net-mvc/</a></p>
  
  <p>To reproduce what I am saying go to *<a href="http://text-encoding-aspnet-mvc-by-example.azurewebsites.net/home/cms" rel="noreferrer">this url</a> and in the text box type <code>&lt;script&gt;alert('This is a bad script, data');&lt;/script&gt;</code> and click the button.</p>
  
  <p>*This link is from Michael Kennedy's blog</p>