title: AntiXSS JavaScriptEncode gets HTML encoded?
body: <p>I've just started using AntiXSS (4.3.0), mostly to use <code>@Encoder.JavaScriptEncode</code> as described <a href="http://weblogs.asp.net/jongalloway/preventing-javascript-encoding-xss-attacks-in-asp-net-mvc" rel="nofollow">here</a>.</p>
  
  <p>I installed AntiXSS from Nuget, then added <code>encoderType="Microsoft.Security.Application.AntiXssEncoder, AntiXssLibrary"</code> to <code>&lt;httpRuntime</code> in my Web.config.</p>
  
  <p>In my view, I have the following line (within <code>&lt;script&gt;</code> tags):</p>
  
  <pre><code>var userId = @Encoder.JavaScriptEncode(User.Identity.GetUserId());
  </code></pre>
  
  <p>Which I would expect to output</p>
  
  <pre><code>var userId = 'user-id';
  </code></pre>
  
  <p>but instead outputs:</p>
  
  <pre><code>var userId = &amp;#39;user-id&amp;#39;;
  </code></pre>
  
  <p>I assume this is happening because Razor is trying to sanitize the HTML, and thus encoding the singe quotes as <code>&amp;#39;</code>. </p>
  
  <p>The solution then would be to just wrap it in <code>Html.Raw()</code>, but in the <a href="http://weblogs.asp.net/jongalloway/preventing-javascript-encoding-xss-attacks-in-asp-net-mvc" rel="nofollow">post I was following</a> he never does that (instead wrapping the whole thing in single quotes within the Javascript).</p>
  
  <p>My question is - are you supposed to need to call <code>@Html.Raw(Encoder.JavaScriptEncode(data))</code>, or is there something wrong with my setup?</p>
  
  <p>Thanks!</p>