Rich Text vs XSS - vb.net

Question

I'm still a newwbie in ASP.Net and don't get how to fix the following problem.
I need rich text to be published on my project. I added NicEdit because it seems to be easy to use.
So, as foreseen, i got an error from the server.
A potentially dangerous Request.Form value was detected from the client(compteRendu="blablbab<br><br>test<br>").
I tryed to fix it by using htmlencoder, but I failed at using it.
What I did :
<script type="text/VB">
htmlEncode {
model.compteRendu = HtmlEncode(model.compteRendu)
}
</script>
#Using Html.BeginForm(IsPost)
#Html.ValidationSummary(True)
#<fieldset>
<legend>meeting</legend>
#Html.HiddenFor(Function(model) model.idmeeting)
<div class="editor-label">
#Html.LabelFor(Function(model) model.compteRendu)
</div>
<div class="editor-field">
#Html.TextAreaFor(Function(model) model.compteRendu)
#Html.ValidationMessageFor(Function(model) model.compteRendu)
</div>
<p>
<input type="submit" value="Save" onclick="htmlEncode"/>
</p>
</fieldset>
End Using
So, what have I done wrong? I also tryed to do this inside the controller but I didn't find any method which was supposed to encode the Html
' POST: /Meeting/Edit/5
<HttpPost()>
Function Edit(meeting As meeting) As ActionResult
meeting.compteRendu = HttpEncode(meeting.compteRendu)
If ModelState.IsValid Then
...
ps : I'm not a native english speaker, sorry if my english sucks.
edit :
For the moment, I'm not needing more than something that allows me to replace my "new lines" by .
So, I've found that I could do iit like that :
#Html.Raw(meeting.compteRendu.Replace(System.Environment.NewLine, "<br />"))
For the moment, it's ok for me. But I'm not sure, maybe I'll need to create text with colors, and so on. So if you've an idea on how I can send validated rich text to my database, I'll be very happy.

Answer 1

You could decorate the compteRendu property on your view model with the <AllowHtml> attribute:
<AllowHtml()>
Public Property compteRendu As String
This will accept any characters in this property. Inside your view you don't need to do any encodings:
#ModelType Meeting
#Using Html.BeginForm(IsPost)
#Html.ValidationSummary(True)
#<fieldset>
<legend>meeting</legend>
#Html.HiddenFor(Function(model) model.idmeeting)
<div class="editor-label">
#Html.LabelFor(Function(model) model.compteRendu)
</div>
<div class="editor-field">
#Html.TextAreaFor(Function(model) model.compteRendu)
#Html.ValidationMessageFor(Function(model) model.compteRendu)
</div>
<p>
<input type="submit" value="Save" />
</p>
</fieldset>
End Using
Neither inside your controller action:
' POST: /Meeting/Edit/5
<HttpPost()>
Function Edit(meeting As meeting) As ActionResult
If ModelState.IsValid Then
...
End If
...
End Function