Somewhere in most content-driven ASP.NET apps is a plain multi-line textbox where a human is expected to write something rich — a product description, an article, an email template — with no way to format it. Replacing that box with a WYSIWYG editor is a small change with an outsized effect on the people who use it every day.
What the editor has to preserve
The replacement only counts as clean if the editor behaves like the field it replaces. That means three things: it posts its value back on submit, it participates in validation, and it repopulates correctly after a postback or a validation error. An editor that loses content on a failed submit is worse than the textbox it replaced.
The swap
- Add the editor component to your project and register it on the page.
- Replace the
<asp:TextBox>with the editor control in the same spot in your form. - Read the editor's value on the server exactly where you read the textbox's value before.
- Re-bind that value when the page reloads so edits survive a postback.
Cute Editor for ASP.NET is designed for this drop-in role, so the change to your server-side code is minimal. On classic ASP, Cute Editor for Classic ASP does the same job.
Sanitize on the server — every time
The moment users can submit HTML, you must sanitize it on the server before storing or rendering. Configure which tags and attributes are allowed and strip everything else. Client-side rules improve the experience but are not a security boundary; the server is. This is the single most important step, and the one most often skipped.
Handle images and pasted content
Authors will paste from Word and drag in images. Decide where uploaded images are stored and make sure pasted markup is cleaned so a single paste does not drag in a page's worth of foreign styles. A good editor does most of this for you; confirm it does before you ship.
Give authors the tools they expect
Bold, links, lists, tables, and image insertion cover most authoring. Turn off toolbar buttons you do not want people using, so the output stays consistent with your design system. Fewer, well-chosen controls beat an overwhelming toolbar.
Frequently asked questions
Will the editor work with my existing validation?
A well-designed editor posts its value like a normal form field, so server-side validation continues to work. Always validate and sanitize the submitted HTML on the server.
How do I stop users pasting messy HTML?
Use an editor that cleans pasted content and configure an allow-list of permitted tags, then enforce the same allow-list on the server when you save.
Get started
Self-hosted components, built to last.
Richscripts products are licensed once and run on your own servers, with source code available. Explore the full product line or talk to the team about your use case.