How to extend Html.Raw in order to Sanitize dangerous HTML data before displaying
<p>I inherited a web-app which already has some input fields accepting plain Html from user. <em>(you may understand that the XSS (Cross Site Scripting) bell rings here...! )</em></p>

<p>The same input is displayed on specific view pages with the use of @Html.Raw <em>(... the bell now rings louder)</em></p>

<p>And, to be able to do that work, the [ValidateInput(false)] decorator on the Controller and  [AllowHtml] on the Model field, comes to fill the picture... <em>(what can i say about the bell!!!)</em></p>

<p>Now, <em>before someone convicts some programmer to death</em> :-) let me make clear that this dangerous input functionality is allowed to users of specific-admin-role. So this is kind of controlled situation.</p>

<p>Lately, though, we decided to <strong>add some control</strong> to this situation, as this functionality creates risk from inside, in case of malicious behavior of the admin user himself.</p>

<p><strong>The easy implementable option</strong> would be to disable this whole funcionality and add some Markdown editor instead, which will store harmless Rich-Text-Format input, BUT still I would have to transform all the <strong>existing data</strong> to this Markdown, so that they display correctly.</p>

<p><strong>What I need, though,</strong> is to be able to lower the risk of inside - <strong>not eliminate</strong> - by adding some sort of Filter of Script tags and other dangerous tags, as an extension of the existing Html.Raw helper.</p>

<p>Can anyone suggest a way to extend or wrap the existing HtmlHelper, please?</p>

<p>Here is the Metadata info:</p>

<pre><code>// Summary:
//     Returns markup that is not HTML encoded.
//
// Parameters:
//   value:
//     The HTML markup.
//
// Returns:
//     The HTML markup without encoding.
public IHtmlString Raw(string value);
</code></pre>