title: Preventing cross-site scripting in ASP.NET MVC - using jQuery or standard HtmlHelpers
body: <p>I am building an ASP.NET MVC application that is AJAX-driven.
  For some reason I need to add some DOM elements on the fly when clicking a submit button. This is accomplished with jQuery.append().</p>
  
  <p>One element inserted is a textarea, whose the data must be parse before submitting to ensure that no cross-site scripting can be done.</p>
  
  <p>We know that the Html.Encode() works great but must be declared outside a script tag. All I have done with jQuery is embedded within a script tag.</p>
  
  <p>1) Is there a way to take advantage of the Html.Encode() within a script tag? </p>
  
  <p>2) How can I accomplish this with jQuery?</p>
  
  <p>At worst I can use HttpUtility.HtmlEncode(), which is called on the server-side.</p>
  
  <p>Thanks for your help.</p>
  
  <p>Roland</p>