Is the AllowHtml attribute secure <p>I have a MVC model field that the user enters some html source code into. Currently, I am getting the following error:</p> <blockquote> <p>A potentially dangerous Request.Form value was detected from the client</p> </blockquote> <p>I have had a look at the following resource: <a href="http://blogs.msdn.com/b/marcinon/archive/2010/11/09/mvc3-granular-request-validation-update.aspx" rel="nofollow">http://blogs.msdn.com/b/marcinon/archive/2010/11/09/mvc3-granular-request-validation-update.aspx</a></p> <p>The resource says to add the <code>AllowHtml</code> attribute. I have added this attribute, and the error is now not occuring.</p> <p>My question is this: Is there any other security features that I should add to my application, or is the <code>AllowHtml</code> attribute all that is required? Should I also use the following protection library: <a href="http://wpl.codeplex.com/" rel="nofollow">http://wpl.codeplex.com/</a></p> <p>Thanks in advance</p>