asp.net mvc - Prevent XSS attacks and still use Html.Raw -
i have cms system using ck editor enter data. if user types in <script>alert('this bad script, data');</script> ckeditor fair job , encodes correctly , passes <script>alert('this bad script, data')</script> server. but if user goes browser developer tools (using inspect element) , adds inside shown in below screen shot when trouble starts. after retrieving db when displayed in browser presents alert box. so far have tried many different things 1 them encode contents using antixssencoder [ httputility.htmlencode(contents) ] , store in database , when displaying in browser decode , display using mvchtmlstring.create [ mvchtmlstring.create(httputility.htmldecode(contents)) ] or html.raw [ html.raw(contents) ] may expect both of them displays javascript alert. i don't want replace <script> manually thru code not comprehensive solution (search "and encoded state:"). so far have referre