asp.net - How should I store comments in database so that I can efficiently display them on page as html text? -

i have form use enters multiple line of texts in text area. of lines can have html markups well. 1 line bold.

how should save text in database? should store them this?

this greap post <br/> love type of findings. <br/> <br/> sharing 

or this?

this greap post <br/> love type of findings. <br/> <br/> sharing 

during editing: must show text entered. line break replaced new line way use sees there line break. textarea won't unserstand br markup

during displaying: must render text appears on page:

this greap post  love type of findings.   sharing 

i want know cleanest way store text can have markup in them.

thanks help

since want output html, have store input in it's raw format in database. there 1 catch though. never should trust input, since input evil, in case, since outputting html directly inputted, opens possibility of cross-site scripting (xss) attack.

you have got 2 options:

1. use html sanitizer let's remove tags not known safe. sanitizer 1 comes microsoft antixss toolkit.

2. encode input , decode parts of result known safe, instance:

string[] safelist = { "<br/>", "<b>", "</b>", "<i>", "</i>" };  public static string encodeinputwithsafelist(string unsafeinput) {     // first: encode complete input.     string safeinput = encoder.htmlencode(unsafeinput);      // next: decode each tag known safe.     foreach (string safetag in safelist)     {         string encodedtag = encoder.htmlencode(safetag, false);         safeinput = safeinput.replace(encodedtag, safetag);     }      return safeinput; } 

note: example uses encoder class microsoft antixss toolkit.

now question becomes, @ point should clean up. should encode output before send client , not store encoded in database, since depends on output type (html, pdf, json) how data should encoded. amplified fact in case there bug in encoder, there no way fix it, since data encoded.

in case bit more tricky though, since input html , not text. sanitizing still want before hand, because way prevent bad input entering database. encodeinputwithsafelist method bit tricky, because both sanitizer , encoder. when run before goes database, prevents output changing when change safe list. can both thing , bad thing, when add new tags safe list, wouldn't want old data change. in case go input encoding, instead of output encoding.

when go input encoding, name database column in such way clear we're dealing sanitized, encoded data.