title: Do we still need to disable request validation when using Razor?
body: <p>In ASP.NET MVC views, it is typical to bind model values using Razor's syntax:</p>
  
  <pre><code>@Html.DisplayFor(m =&gt; m.Name)
  </code></pre>
  
  <p>We know that Razor will html encode the value by default. But imagine a malicious user inputting scripts in a textbox and submitting it:</p>
  
  <pre><code>&lt;script&gt;alert('Executing evil script')&lt;/script&gt;
  </code></pre>
  
  <p>Now if we do not use the <code>[ValidateInput(false)]</code> or <code>[AllowHtml]</code> attributes, we will be hit with a <code>HttpRequestValidationException</code> which means this exception have to be caught every time a user submits a form.</p>
  
  <p>From the answer in another stackoverflow <a href="https://stackoverflow.com/questions/81991/a-potentially-dangerous-request-form-value-was-detected-from-the-client">question</a>, I know we can disable request validation on an application level but many are suggesting this is a bad practice.</p>
  
  <p>My question is, given we have Razor to escape all <code>&amp;gt;</code> and <code>&amp;lt;</code>, can we assume the site will still be secure if we turn off request validation?</p>