title: Javascript injection attack prevention for textboxes
body: <p>say I have a textBox and a property to get and set its value:</p>
  
  <pre><code>public SomeText
  {
     get { return HttpUtility.HtmlEncode(textBox.Text); }
     set { textBox.Text = HttpUtility.HtmlEncode(value); }
  }
  </code></pre>
  
  <p>I have used HtmlEncode to prevent Javascript injection attacks. After thinking about it though I'm thinking I only need the HtmlEncode on the getter. The setter is only used by the system and can not be accessed by an external user.</p>
  
  <p>Is this correct?</p>