When in doubt, go to the source (or decompile):
In HtmlContainerControl
:
public virtual string InnerText
{
get
{
return HttpUtility.HtmlDecode(this.InnerHtml);
}
set
{
this.InnerHtml = HttpUtility.HtmlEncode(value);
}
}
public virtual string InnerHtml
{
get
{
if (base.IsLiteralContent())
{
return ((LiteralControl)this.Controls[0]).Text;
}
if (this.HasControls() && this.Controls.Count == 1 && this.Controls[0] is DataBoundLiteralControl)
{
return ((DataBoundLiteralControl)this.Controls[0]).Text;
}
if (this.Controls.Count == 0)
{
return string.Empty;
}
throw new HttpException(SR.GetString("Inner_Content_not_literal", new object[]
{
this.ID
}));
}
set
{
this.Controls.Clear();
this.Controls.Add(new LiteralControl(value));
this.ViewState["innerhtml"] = value;
}
}
Both properties ultimately use InnerHtml
, but setting InnerText
HTML encodes the value so that it will be displayed literally in the browser versus interpreted as markup.
Remember that assigning to InnerHtml
will not encode the value, and thus any user-driven content should be sanitized prior to assignment.
This also emphasizes how important it is to be mindful of view state (note the last line of InnerHtml
's setter; everything ends up in view state whether or not you need it).