jquery - Javascript decodes encoded string automatically? -

jquery - Javascript decodes encoded string automatically? -

i've been reading blog post , saw says js encoding vulnerability. in sample code below, if user enters :

\x3cscript\x3e%20alert(\x27pwnd\x27)%20\x3c/script\x3e, says js render html looks odd me. tried , right.

@{ viewbag.title = "home page"; } <h2 id="welcome-message">welcome our website</h2> @if(!string.isnullorwhitespace(viewbag.username)) { <script type="text/javascript"> $(function () { //viewbag.username value comes controller. var message = 'welcome, @viewbag.username!'; $("#welcome-message").html(message).hide().show('slow'); }); </script> }

my question is, why javascript decodes encoded string automatically? or have jquery's html() function that? op says utilize ajax.encodejavascriptstring() method in order solve problem. why need encode encoded string? checked jquery's website , doesn't mention html() method.

if see whole blog post, please visit address http://weblogs.asp.net/jgalloway/archive/2011/04/28/preventing-javascript-encoding-xss-attacks-in-asp-net-mvc.aspx

have @ html result:

<script type="text/javascript"> $(function () { var message = 'welcome, \x3cscript\x3e alert(\x27pwnd\x27) \x3c/script\x3e!'; $("#welcome-message").html(message).hide().show('slow'); }); </script>

yet, js string contains character escape sequences , equal to

'welcome, <script> alert("pwnd") </script>!'

so, want escape these escape sequences (including simple things \n or \t) js string delimiters ' , " - using @encoder.javascriptencode.

javascript jquery asp.net-mvc