HTML Text encoding of web controls

[Guogang]

I find that the encoding of web control is inconsistent. Some controls will
do an HTML encoding on the text, some don't.

Say, I want to show the string "<script> alter("test") <script>". For a
"BoundColumn" used in DataGrid, I get an alert box instead of the string.
But for "TextBox" control, it is encoded correctly.

Is there a general rule, or documentation of which controls will do HTML
encoding automatically, which don't?

Thanks,
Guogang

[Felix Wang]

Are you the former TL of GTEC DSV?

Please ignore this if not...

--
Regards,

Felix Wang

"Guogang" <nospam@no_such_domain.com> wrote in message
news:uRAWjoi1DHA.3436@tk2msftngp13.phx.gbl...

> I find that the encoding of web control is inconsistent. Some controls

will

> do an HTML encoding on the text, some don't.
>
> Say, I want to show the string "<script> alter("test") <script>". For a
> "BoundColumn" used in DataGrid, I get an alert box instead of the string.
> But for "TextBox" control, it is encoded correctly.
>
> Is there a general rule, or documentation of which controls will do HTML
> encoding automatically, which don't?
>
> Thanks,
> Guogang
>
>