title: XSS-safe JsonResult as string
body: <p>I changed my code to not need this answer anymore, but I'm still asking for curiosity's sake.</p>
  
  <p>After much searching I found <a href="https://stackoverflow.com/questions/4571985/jsonresult-to-string">this question</a> and a few others like it. I've been looking for a way to take the JSON that would be returned by a JsonResult and use it in a view. The problem with that answer, and others, is they seem to be unsafe. Some sources I found suggested something like this:</p>
  
  <pre><code>@Html.Raw(Json.Encode(Model))
  </code></pre>
  
  <p>First of all, <code>Json.Encode</code> doesn't seem to exist anymore. Second, If I use Raw, then not only is the JSON syntax unencoded, the model contents aren't either. If a user enters a <code>&lt;script&gt;</code> tag into their information, it will get spit out that way and executed. If I don't use Raw, the JSON is escaped too by the view writer.</p>
  
  <p>The reason I wanted this is because I have a page that's using some jQuery templating, and on first load, I wanted to still use the templates by having the view output a script tag that fired them.</p>