title: How to extend Html.Raw in order to Sanitize dangerous HTML data before displaying
body: <p>I inherited a web-app which already has some input fields accepting plain Html from user. <em>(you may understand that the XSS (Cross Site Scripting) bell rings here...! )</em></p>
  
  <p>The same input is displayed on specific view pages with the use of @Html.Raw <em>(... the bell now rings louder)</em></p>
  
  <p>And, to be able to do that work, the [ValidateInput(false)] decorator on the Controller and  [AllowHtml] on the Model field, comes to fill the picture... <em>(what can i say about the bell!!!)</em></p>
  
  <p>Now, <em>before someone convicts some programmer to death</em> :-) let me make clear that this dangerous input functionality is allowed to users of specific-admin-role. So this is kind of controlled situation.</p>
  
  <p>Lately, though, we decided to <strong>add some control</strong> to this situation, as this functionality creates risk from inside, in case of malicious behavior of the admin user himself.</p>
  
  <p><strong>The easy implementable option</strong> would be to disable this whole funcionality and add some Markdown editor instead, which will store harmless Rich-Text-Format input, BUT still I would have to transform all the <strong>existing data</strong> to this Markdown, so that they display correctly.</p>
  
  <p><strong>What I need, though,</strong> is to be able to lower the risk of inside - <strong>not eliminate</strong> - by adding some sort of Filter of Script tags and other dangerous tags, as an extension of the existing Html.Raw helper.</p>
  
  <p>Can anyone suggest a way to extend or wrap the existing HtmlHelper, please?</p>
  
  <p>Here is the Metadata info:</p>
  
  <pre><code>// Summary:
  //     Returns markup that is not HTML encoded.
  //
  // Parameters:
  //   value:
  //     The HTML markup.
  //
  // Returns:
  //     The HTML markup without encoding.
  public IHtmlString Raw(string value);
  </code></pre>