Skip to content

Commit ea4a28b

Browse files
Add a note in the PosInformatique.Foundations.Text.Templating.Razor readme about the HTML encoding.
1 parent df18662 commit ea4a28b

File tree

1 file changed

+14
-0
lines changed

1 file changed

+14
-0
lines changed

src/Text.Templating.Razor/README.md

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,20 @@ Formatted data: @this.Formatter.Format(Model)
155155

156156
As long as `IDateTimeProvider` and `IMyFormatter` are registered in the `IServiceCollection`, they are available during template rendering.
157157

158+
## HTML rendering and character encoding
159+
160+
The output of Razor templates is standard HTML. This means that special characters (including accents)
161+
are HTML-encoded by default when using expressions like `@Model.Name`.
162+
163+
If you need to output already-encoded or raw HTML content from your model, you must explicitly disable HTML
164+
encoding in your Razor template, for example:
165+
166+
```razor
167+
@Html.Raw(Model.Name)
168+
```
169+
170+
Use this only when you are sure that the content is safe (to avoid XSS vulnerabilities).
171+
158172
## Links
159173

160174
- [NuGet package: Emailing.Templates.Razor](https://www.nuget.org/packages/PosInformatique.Foundations.Emailing.Templates.Razor/)

0 commit comments

Comments
 (0)