BoundField.HtmlEncode Property
Gets or sets a value indicating whether field values are HTML-encoded before they are displayed in a BoundField object.
Namespace: System.Web.UI.WebControls
Assembly: System.Web (in System.Web.dll)
Property Value
Type: System.Booleantrue if field values are HTML-encoded before they are displayed in a BoundField object; otherwise, false. The default is true.
Use the HtmlEncode property to specify whether field values are HTML-encoded to their respective string representations before they are displayed in a BoundField object. For example, if this property is true, a string value of "<script>" would be rendered as "<script>". If this property is false, the string would be rendered unchanged.
 Note |
|---|
HTML-encoding field values helps to prevent cross-site scripting attacks and malicious content from being displayed. This property should be enabled whenever possible. |
The following code example demonstrates how to use the HtmlEncode property to prevent field values from being HTML-encoded before being displayed in a BoundField object.
<%@ Page language="C#" %> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" > <head runat="server"> <title>BoundField Example</title> </head> <body> <form id="form1" runat="server"> <h3>BoundField Example</h3> <asp:gridview id="CustomersGridView" datasourceid="CustomersSqlDataSource" autogeneratecolumns="false" allowpaging="true" runat="server"> <columns> <asp:boundfield datafield="CustomerID" readonly="true" headertext="Customer ID"/> <asp:boundfield datafield="CompanyName" htmlencode="false" headertext="Customer Name"/> <asp:boundfield datafield="Address" htmlencode="false" headertext="Address"/> <asp:boundfield datafield="City" htmlencode="false" headertext="City"/> <asp:boundfield datafield="PostalCode" htmlencode="false" headertext="ZIP Code"/> <asp:boundfield datafield="Country" htmlencode="false" headertext="Country"/> </columns> </asp:gridview> <!-- This example uses Microsoft SQL Server and connects --> <!-- to the Northwind sample database. Use an ASP.NET --> <!-- expression to retrieve the connection string value --> <!-- from the Web.config file. --> <asp:sqldatasource id="CustomersSqlDataSource" selectcommand="Select [CustomerID], [CompanyName], [Address], [City], [PostalCode], [Country] From [Customers]" connectionstring="<%$ ConnectionStrings:NorthWindConnectionString%>" runat="server"> </asp:sqldatasource> </form> </body> </html>
Windows 8, Windows Server 2012, Windows 7, Windows Vista SP2, Windows Server 2008 (Server Core Role not supported), Windows Server 2008 R2 (Server Core Role supported with SP1 or later; Itanium not supported)
The .NET Framework does not support all versions of every platform. For a list of the supported versions, see .NET Framework System Requirements.
