title: Cross site scripting possibility?
body: <p>If i pass this value  </p>
  
  <pre><code>return String.Format(CultureInfo.InvariantCulture, "&lt;input type=\"hidden\" id=\"{0}\" post=\"True\" type=\"{1}\" value=\"{2}\" /&gt;", controlId,type,post)
  </code></pre>
  
  <p>to a text box, is this exposed to XSS? Since I am new to this can anyone help me with this?</p>