title: Does Bind() or Eval() automatically HtmlEncode to protect against XSS?
body: <p>Forgive me if this is a silly question.  I haven't been able to find the answer stated explicitly.</p>
  
  <p>I rarely use Bind() or Eval() in my aspx pages, and instead use the following syntax: (Assume this is in an ItemTemplate in a Repeater control)</p>
  
  <pre><code>&lt;asp:Label id="lblFirstName" runat="server" Text='&lt;%# Microsoft.Security.Application.AntiXss.HtmlEncode(DataBinder.Eval(Container.DataItem, "FirstName").ToString()) %&gt;
  </code></pre>
  
  <p>I started doing this a long time ago and simply never questioned it, but now it occurs to me that this may be overkill.  And now I'm using a CMS that uses this syntax all over the place:</p>
  
  <pre><code>&lt;asp:Label id="lblFirstName" runat="server" Text='&lt;%# Bind("FirstName") %&gt;
  </code></pre>
  
  <p>So I'm wondering, basically, if I use Bind() or Eval() does the runtime automatically HtmlEncode the output?  Have I been doing unnecessary coding all along?</p>