title: Does the standard Html.DisplayTextFor() no HTML encoding?
body: <p>We are currently dealing with some XSS issues on one of our ASP.NET MVC projects. I found two issues - the first one has to do with our request validation pattern. The attacker could now use this security hole to drop some bad content in our database. </p>
  
  <p>The second issue is how we display this content and we use the Html.DisplayTextFor method and it seems to be "broken".</p>
  
  <p>Just create a new MVC 3 WebApp, put this in the HomeController:</p>
  
  <pre><code>public class HomeController : Controller
  {
      public ActionResult Index()
      {
          ViewBag.Message = "&lt;SCRIPT/XSS SRC=\"htpp://ha.ckers.org/css.js\"&gt;";
  
          User foo = new User();
          foo.Name = "&lt;SCRIPT/XSS SRC=\"htpp://ha.ckers.org/css.js\"&gt;";
  
          return View(bla);
      }
  
      public ActionResult About()
      {
          return View();
      }
  }
  
  public class User
  {
      public string Name { get; set; }
  } 
  </code></pre>
  
  <p>The View:</p>
  
  <pre><code>@Html.TextBoxFor(m =&gt; m.Name) &lt;br/&gt; ||| &lt;-- will be encoded
  
  @Html.Encode(ViewBag.Message)&lt;br/&gt; ||| &lt;-- will be double encoded
  
  @Model.Name &lt;br/&gt; ||| &lt;-- will be encoded 
  
  @Html.DisplayTextFor(m =&gt; m.Name) &lt;-- no encoding
  &lt;br/&gt; ||| 
  </code></pre>
  
  <p>Output of the DisplayTextFor will be the whole string <code>&lt;script xss="" src="htpp://ha.ckers.org/css.js"&gt;</code> </p>
  
  <p>Question is: Bug, feature or am I using it wrong?</p>