What does the new syntax <%:%> do in Visual Studio 2010?

Question

Scott Hanselman’s latest blog post on VS 2010’s new features mentions “new syntax <%:%>”. What does it do? Searching for these tags with google is not possible ...

Thanks,

Adrian

Answer 1

It outputs HTML with encoded objects. It is short for

 <%= HttpUtility.HtmlEncode("Some string") %> 

In addition, it can be expanded to provide additional cool material, such as output protection against XSS, as Phil Haack demonstrated .

Phil Haack , Scott Guthrie, and Scott Hanselman actively talk about the new and improved features of .NET 4.

Answer 2

It automatically encodes the encoded HTML expression.

So...

 <%: yourString %> 

... is equivalent ...

 <%= HttpUtility.HtmlEncode(yourString) %> 

See the following MSDN link for more information:

• HTML encoded expressions

Answer 3

I think it ensures that the text contained inside is misinformed so that the java script cannot be injected into the page

so if you have

 userdata = alert ("textstring") <%= userdata %> 

a message appears on the page

 <%: userdata %> 

will display a text warning ("textstring") '

Answer 4

In fact, this Google search leads me to this explanation of Scott Guthrie .

Answer 5

Its purpose is to help prevent XSS attacks using HTML encoding.