Do I need to encode attribute values in MVC Razor?

Razor performs HTML encoding on strings by default. Depending on where your string is being injected into the HTML stream, this may or may not be the correct encoding to use. If it's not the correct encoding, then you need to perform the correct encoding yourself and be sure to return an MvcHtmlString (i.e. an IHtmlString) to ensure Razor leaves your custom encoding alone.

Since Razor uses HTML encoding, which is technically different from HTML attribute encoding (it's a subset), it's not wrong to use @Html.Raw(Html.AttributeEncode(Model.Value)) to HTML attribute encode the value. At the same time, it's also not necessary, since the default HTML encoding uses the same basic format and will just end up encoding a couple character that otherwise wouldn't need encoded in an HTML attribute value.

On the other hand, in the final case where a string is being injected into the quotes of a JavaScript string, the HTML encoding would absolutely be incorrect, so you'd definitely need to perform the encoding yourself as I did: @Html.Raw(HttpUtility.JavaScriptStringEncode(Model.Value)).

在Razor中输出Html的两种方式

Razor中所有的Html都会自动编码，这样就不需要我们手动去编码了（安全），但在需要输出Html时就是已经转义过的Html文本了，如下所示：

string thisTest = "<span style="color:#f00;">qubernet</span>";

}

@thisTest;

这样在页面输出的文本就是：<span style="color:#f00;">qubernet</span>而不是红色的字体了，要输出红色的字体，有下面常用的两种方式：

1. 使用Razor中的Html.Raw（推荐使用这种方式）：
@{
string thisTest = "<span style="color:#f00;">qubernet</span>";
}
@Html.Raw(thisTest);

2. 使用MvcHtmlString类来实现：
@{
string thisTest = "<span style="color:#f00;">qubernet</span>";
var thisResult = new MvcHtmlString(thisTest);
}
@thisResult或@(new HtmlString(thisTest))

@Html.Raw()

@Html.Raw() 方法输出带有html标签的字符串，如：
@Html.Raw("<div style='color:red'>输出字符串</div>")
结果：输出字符串