Untouched generated code here:
@page
@model pcore31.AddpetModel
@{
Layout = null;
}
<!DOCTYPE html><html><head><meta name="viewport" content="width=device-width" /><title>Addpet</title></head><body><h4>Pet</h4><hr /><div class="row"><div class="col-md-4"><form method="post"><div asp-validation-summary="ModelOnly" class="text-danger"></div><div class="form-group"><label asp-for="Pet.PetName" class="control-label"></label><input asp-for="Pet.PetName" class="form-control" /><span asp-validation-for="Pet.PetName" class="text-danger"></span></div><div class="form-group"><label asp-for="Pet.Dogpic" class="control-label"></label><input asp-for="Pet.Dogpic" class="form-control" /><span asp-validation-for="Pet.Dogpic" class="text-danger"></span></div><div class="form-group"><label asp-for="Pet.Odate" class="control-label"></label><input asp-for="Pet.Odate" class="form-control" /><span asp-validation-for="Pet.Odate" class="text-danger"></span></div><div class="form-group form-check"><label class="form-check-label"><input class="form-check-input" asp-for="Pet.Ocheck" /> @Html.DisplayNameFor(model => model.Pet.Ocheck)</label></div><div class="form-group"><input type="submit" value="Create" class="btn btn-primary" /></div></form></div></div><div><a asp-page="Index">Back to List</a></div>
@section Scripts {
@{await Html.RenderPartialAsync("_ValidationScriptsPartial");}
}</body></html>Take for example this line:
<input asp-for="Pet.PetName" class="form-control" />
Is that asp-for also appling the equal to htmlentities? Or will I have to modify the code and do that myself.
A search I got punching in "<input asp-for" yielded https://docs.microsoft.com/en-us/aspnet/core/mvc/views/tag-helpers/intro?view=aspnetcore-3.1
I searched that page for "encode", "entity", "enti", "santi", "sanitize. No hits at all.
So if the generated pages doesn't sanitize data, why are they used? I normally sanitize the request, but again if I have to sanitize each field, why the auto context instead of individual request?
For example:
string petname = Request.Form["petname"]; // I could add a custom sanitize class string petname = Helper.sanitize(Request.Form["petname"]); // Something like that.
Sorry this "generated" code still confuses me.