Bold Text in Html.FormatValue using Razor

Question

I want to have the following result. Username has to be bold:

Blabla Username Bla.

I have the Format in a ressource file:

Blabla {0} Bla.

And in the view I do the following:

@Html.FormatValue(User.Identity.Name, Resources.MyFormatString)

How can I make the Username bold and use Html.FormatValue? Or is there another method to achieve this?

Answer 1

You could simply change your resource to contain the bold-tag, strong-tag or a style.

Like "Blabla <b>{0}</b> Bla.".

[edit]
Indeed, checked Html.FormatValue for an escape functionality, did not see one, but apparently it does :)

In that case using @Html.Raw and string.Format will work.

@Html.Raw(string.Format(Resources.MyFormatString, "SomeName"))

(tested in MVC 5, but @Html.Raw is also available in 4)

Also a small note: storing HTML in resources is probably not the best idea, mixing UI & content.
[/edit]

Answer 2

I wanted to solve your example with including html tags, be safe with html characters in the resources, and safely include user input or html tags. My solution of your example is

@(Resources.MyFormatString.FormatWithHtml(
    "<b>" + HttpUtility.HtmlEncode(User.Identity.Name) + "</b>"))

using my function FormatWithHtml

/// Encodes to MvcHtmlString and includes HTML tags or already encoded strings, placeholder is the '|' character
public static MvcHtmlString FormatWithHtml (this string format, params string[] htmlIncludes) 
{
    var result = new StringBuilder();
    int i = -1;
    foreach(string part in format.Split('|')) {
        result.Append(HttpUtility.HtmlEncode(part));
        if (++i < htmlIncludes.Length)
            result.Append(htmlIncludes[i]);
    }
    return new MvcHtmlString(result.ToString());
}

One more example, this

@("Resource is safe to html characters <&> and will include |format tags| or any | user input."
    .FormatWithHtml("<b>", "</b>", "<b id='FromUser'>" +HttpUtility.HtmlEncode("<a href='crack.me'>click</a>") +"</b>"))

will write to your razor page

Resource is safe to html characters <&> and will include format tags or any <a href='crack.me'>click</a> user input.