title: Should Html.Encode be called when building ActionLinks in ASP.NET MVC
body: <p>If the name of a link is pulled from the database, should you be calling the Html.Encode method to clean the name?</p>
  
  <p>For example:</p>
  
  <pre><code>Html.ActionLink(Model.PersonFromDB.FirstName,
                  "Action",
                  "Controller",
                  new RouteValueDictionary { { "id", Model.PersonFromDB.Id } },
                  null)
  </code></pre>
  
  <p>or:</p>
  
  <pre><code>Html.ActionLink(Html.Encode(Model.PersonFromDB.FirstName),
                  "Action",
                  "Controller",
                  new RouteValueDictionary { { "id", Model.PersonFromDB.Id } },
                  null)
  </code></pre>
  
  <p>It would make sense that you would want to do this to ensure that there are no dangerous strings injected into the page between <code>&lt;a&gt;</code> and <code>&lt;/a&gt;</code> tags, but are scripts and such executable between anchor tags?</p>