title: <%: %> vs Microsoft the anti XSS library
body: <p>With .net 4 there's a new &lt;%: %> script enclosure that's like &lt;%= %> but does an html encode.  People are encouraging the use of this new syntax.</p>
  
  <p>My question is, does &lt;%: %> protect against XSS better or as well as using the Microsoft Anti XSS library?</p>
  
  <p>A Microsoft security person once told me to never just use HTML Encode as it doesn't protect very well and that I should always use the Anti XSS library (or another library).  Is that still true with &lt;%: %>?  Or can I confidently use &lt;%: %> knowing it's going to protect my app from XSS like people are saying?</p>