How do ASP.NET Core view engines and Controllers protect an application against Cross-Site Scripting (XSS)?

Short answer

Razor automatically encodes @Model output with HtmlEncoder to neutralize dangerous characters, and JavaScriptEncoder secures data injected inside scripts.

Explanation

In Razor pages, text printed with @Model.Text is encoded safely (for example, < becomes &lt;). For data injected inside <script> tags, JavaScriptEncoder.Default.Encode prevents breaking out of a variable's context. Use @Html.Raw only for trusted, clean content that has been sanitized with a library such as Ganss.Xss.HtmlSanitizer.

Code example

<!-- Automatically encrypted and secure -->
<p>@Model.UserComment</p>

<!-- Extremely dangerous; use only with trusted and sanitized input: -->
<!-- @Html.Raw(Model.UserComment) -->

Common mistakes

• Using @Html.Raw to display unsanitized user comments, directly enabling stored XSS.

Follow-up questions

• What is Overposting / Mass Assignment in ASP.NET Core, and how do you prevent it?

Sources

• Microsoft Learn — Prevent Cross-Site Scripting (XSS) in ASP.NET Core