The answers to the question are still useful.
You are also considering this for WinForms, as I understand from the tags.
If you want to do some kind of action like this in web forms, you have to consider that the text from the file comes without any encoding to control the label. Thus, any JavaScript code can be entered.
Always HtmlEncode your text;
var pathToFile = Server.MapPath("~/poo.txt"); lblPoo.Text = HttpUtility.HtmlEncode(File.ReadAllText(pathToFile));
tugberk
source share