Can someone explain to me the design tradeoff that was made to always HTMLEncode text from the DNN text editor control (DotNetNuke.UI.UserControls.TextEditor)?

It seems odd to me because the primary use of the control that I've seen is to host the HTML Editor provider for Rich Text. When a user has entered Rich Text (wth Html formatting that needs to be preserved) there is no need for HtmlEncoding. It appears to me that DNN is simply:

• On Edit: Html Encoding strings and storing Html Encoded strings in the database
• On View: Decoding the strings for presentation as un-encoded HTML.

So, it seems that we haven't really gained anything. All we've done is added an extra step every time we want to process a string (like in GetSearchItems).

Perhaps this makes more sense if the TextEditor is limited to Basic Textbox and Text mode. Is that the case?

Is there an advantage to having HtmlEncoded strings in my database that I'm missing?

That's right Chris. This is a function that is handled in the "context.server" namespace or HttpContext to purists. The reason for storing the text  encoded is reasonably simple. Most people who use the module want to use it like a word editor. Since many users do not know html, it makes sense to to the work for them. If you have a requirement that states otherwise, it might make sense to modify the module (or copy it) to use the Context.Server.HtmlDecode(string) and the Context.Server.HtmlEncode(string) functions to display exactly what is typed into a regular textarea control without any "help" from the .NET framework.

Just in case anyone stumbles on this thread and want some helpful information, here are a couple of useful links:

http://dotnetnuke.com/Community/ForumsDotNetNuke/tabid/795/forumid/8/threadid/11753/scope/posts/Default.aspx is a thread which has some of my rants about lack of HtmlEncoding and XSS prevention in some DNN modules.

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag2/html/paght000004.asp is a good intro article from Microsoft on general XSS and HtmlEncoding issues. It is a little naive about the threat, but it is a good introduction.