Use IHtmlGenerator / TagBuilder in necessary tag helpers

framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap/TagHelpers/AbpTagHelperService.cs

@@ -5,6 +5,7 @@ using System.Linq;
 using System.Reflection;
 using System.Text.Encodings.Web;
 using System.Threading.Tasks;
+using Microsoft.AspNetCore.Html;
 using Microsoft.AspNetCore.Mvc.ViewFeatures;
 using Microsoft.AspNetCore.Razor.TagHelpers;
 using Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Form;
@@ -51,5 +52,14 @@ namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers
             Process(context, output);
             return Task.CompletedTask;
         }
+
+        protected string RenderHtml(IHtmlContent content)
+        {
+            using (var writer = new StringWriter())
+            {
+                content.WriteTo(writer, HtmlEncoder.Default);
+                return writer.ToString();
+            }
+        }
     }
 }

framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap/TagHelpers/Breadcrumb/AbpBreadcrumbItemTagHelperService.cs

@@ -1,6 +1,7 @@
-using System.Collections.Generic;
-using System.Text.Encodings.Web;
+using Microsoft.AspNetCore.Mvc.Rendering;
 using Microsoft.AspNetCore.Razor.TagHelpers;
+using System.Collections.Generic;
+using System.Text.Encodings.Web;
 using Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.Microsoft.AspNetCore.Razor.TagHelpers;
 using Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Extensions;
 
@@ -14,6 +15,7 @@ namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Breadcrumb
         {
             _encoder = encoder;
         }
+
         public override void Process(TagHelperContext context, TagHelperOutput output)
         {
             output.TagName = "li";
@@ -23,7 +25,7 @@ namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Breadcrumb
 
             var list = context.GetValue<List<BreadcrumbItem>>(BreadcrumbItemsContent);
 
-            output.Content.SetHtmlContent(GetInnerHtml(context, output));
+            ProcessContent(context, output);
             
             list.Add(new BreadcrumbItem
             {
@@ -34,15 +36,21 @@ namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Breadcrumb
             output.SuppressOutput();
         }
 
-        protected virtual string GetInnerHtml(TagHelperContext context, TagHelperOutput output)
+        protected virtual void ProcessContent(TagHelperContext context, TagHelperOutput output)
         {
             if (string.IsNullOrWhiteSpace(TagHelper.Href))
             {
                 output.Attributes.Add("aria-current", "page");
-                return TagHelper.Title;
+                output.Content.Append(TagHelper.Title);
             }
-            return "<a href=\"" + TagHelper.Href + "\">" + TagHelper.Title + "</a>";
-        }
+            else
+            {
+                var link = new TagBuilder("a");
+                link.Attributes.Add("href", TagHelper.Href);
+                link.InnerHtml.Append(TagHelper.Title);
 
+                output.Content.AppendHtml(link);
+            }
+        }
     }
 }

framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap/TagHelpers/Carousel/AbpCarouselItemTagHelperService.cs

@@ -1,7 +1,7 @@
-using System.Collections.Generic;
-using System.Text;
-using System.Text.Encodings.Web;
+using Microsoft.AspNetCore.Mvc.Rendering;
 using Microsoft.AspNetCore.Razor.TagHelpers;
+using System.Collections.Generic;
+using System.Text.Encodings.Web;
 using Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.Microsoft.AspNetCore.Razor.TagHelpers;
 using Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Extensions;
 
@@ -42,8 +42,12 @@ namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Carousel
 
         protected virtual void SetInnerImgTag(TagHelperContext context, TagHelperOutput output)
         {
-            var imgTag ="<img class=\"d-block w-100\" src=\""+TagHelper.Src+ "\" alt=\"" + TagHelper.Alt + "\">";
-            output.Content.SetHtmlContent(imgTag);
+            var img = new TagBuilder("img");
+            img.AddCssClass("d-block w-100");
+            img.Attributes.Add("src", TagHelper.Src);
+            img.Attributes.Add("alt", TagHelper.Alt);
+
+            output.Content.SetHtmlContent(img);
         }
 
         protected virtual void SetActive(TagHelperContext context, TagHelperOutput output)
@@ -61,14 +65,18 @@ namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Carousel
                 return;
             }
 
-            var html = new StringBuilder("");
+            var title = new TagBuilder("h5");
+            title.InnerHtml.Append(TagHelper.CaptionTitle);
+
+            var caption = new TagBuilder("p");
+            caption.InnerHtml.Append(TagHelper.Caption);
 
-            html.AppendLine("<div class=\"carousel-caption d-none d-md-block\">");
-            html.AppendLine("<h5>"+TagHelper.CaptionTitle+"</h5>");
-            html.AppendLine("<p>" + TagHelper.Caption + "</p>");
-            html.AppendLine("</div>");
+            var wrapper = new TagBuilder("div");
+            wrapper.AddCssClass("carousel-caption d-none d-md-block");
+            wrapper.InnerHtml.AppendHtml(title);
+            wrapper.InnerHtml.AppendHtml(caption);
 
-            output.PostContent.SetHtmlContent(html.ToString());
+            output.PostContent.SetHtmlContent(wrapper);
         }
 
     }

framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap/TagHelpers/Carousel/AbpCarouselTagHelperService.cs

@@ -1,15 +1,25 @@
-using System;
+using Localization.Resources.AbpUi;
+using Microsoft.AspNetCore.Mvc.Rendering;
+using Microsoft.AspNetCore.Razor.TagHelpers;
+using Microsoft.Extensions.Localization;
+using System;
 using System.Collections.Generic;
 using System.Linq;
 using System.Text;
 using System.Threading.Tasks;
-using Microsoft.AspNetCore.Razor.TagHelpers;
 using Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.Microsoft.AspNetCore.Razor.TagHelpers;
 
 namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Carousel
 {
     public class AbpCarouselTagHelperService : AbpTagHelperService<AbpCarouselTagHelper>
     {
+        protected IStringLocalizer<AbpUiResource> L { get; }
+
+        public AbpCarouselTagHelperService(IStringLocalizer<AbpUiResource> localizer)
+        {
+            L = localizer;
+        }
+
         public override async Task ProcessAsync(TagHelperContext context, TagHelperOutput output)
         {
             output.TagName = "div";
@@ -58,18 +68,45 @@ namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Carousel
                 return;
             }
 
-            var html = new StringBuilder("");
-
-            html.AppendLine("<a class=\"carousel-control-prev\" href=\"#" + TagHelper.Id + "\" role=\"button\" data-slide=\"prev\">");
-            html.AppendLine("<span class=\"carousel-control-prev-icon\" aria-hidden=\"true\"></span>");
-            html.AppendLine("<span class=\"sr-only\">Previous</span>");
-            html.AppendLine("</a>");
-            html.AppendLine("<a class=\"carousel-control-next\" href=\"#" + TagHelper.Id + "\" role=\"button\" data-slide=\"next\">");
-            html.AppendLine("<span class=\"carousel-control-next-icon\" aria-hidden=\"true\"></span>");
-            html.AppendLine("<span class=\"sr-only\">Next</span>");
-            html.AppendLine("</a>");
-
-            output.PostContent.SetHtmlContent(html.ToString());
+            // create 'previous' item
+            var prevIcon = new TagBuilder("span");
+            prevIcon.AddCssClass("carousel-control-prev-icon");
+            prevIcon.Attributes.Add("aria-hidden", "true");
+
+            var prevText = new TagBuilder("span");
+            prevText.AddCssClass("sr-only");
+            prevText.InnerHtml.Append(L["Previous"].Value);
+
+            var prevAnchor = new TagBuilder("a");
+            prevAnchor.AddCssClass("carousel-control-prev");
+            prevAnchor.Attributes.Add("href", "#" + TagHelper.Id);
+            prevAnchor.Attributes.Add("role", "button");
+            prevAnchor.Attributes.Add("data-slide", "prev");
+
+            prevAnchor.InnerHtml.AppendHtml(prevIcon);
+            prevAnchor.InnerHtml.AppendHtml(prevText);
+
+            // create 'next' item
+            var nextIcon = new TagBuilder("span");
+            nextIcon.AddCssClass("carousel-control-next-icon");
+            nextIcon.Attributes.Add("aria-hidden", "true");
+
+            var nextText = new TagBuilder("span");
+            nextText.AddCssClass("sr-only");
+            nextText.InnerHtml.Append(L["Next"].Value);
+
+            var nextAnchor = new TagBuilder("a");
+            nextAnchor.AddCssClass("carousel-control-next");
+            nextAnchor.Attributes.Add("href", "#" + TagHelper.Id);
+            nextAnchor.Attributes.Add("role", "button");
+            nextAnchor.Attributes.Add("data-slide", "next");
+
+            nextAnchor.InnerHtml.AppendHtml(nextIcon);
+            nextAnchor.InnerHtml.AppendHtml(nextText);
+
+            // append post content
+            output.PostContent.AppendHtml(prevAnchor);
+            output.PostContent.AppendHtml(nextAnchor);
         }
 
         protected virtual void SetIndicators(TagHelperContext context, TagHelperOutput output, List<CarouselItem> itemList)
@@ -79,20 +116,24 @@ namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Carousel
                 return;
             }
 
-            var html = new StringBuilder("<ol class=\"carousel-indicators\">");
+            var list = new TagBuilder("ol");
+            list.AddCssClass("carousel-indicators");
 
             for (var i = 0; i < itemList.Count; i++)
             {
-                html.AppendLine(
-                    "<li " +
-                    "data-target=\"#" + TagHelper.Id + "\"" +
-                    " data-slide-to=\"" + i + "\"" +
-                    (itemList[i].Active ? " class=\"active\">" : "") +
-                    "</li>");
+                var listItem = new TagBuilder("li");
+                listItem.Attributes.Add("data-target", "#" + TagHelper.Id);
+                listItem.Attributes.Add("data-slide-to", i.ToString());
+
+                if (itemList[i].Active)
+                {
+                    listItem.AddCssClass("active");
+                }
+
+                list.InnerHtml.AppendHtml(listItem);
             }
 
-            html.AppendLine("</ol>");
-            output.PreContent.SetHtmlContent(html.ToString());
+            output.PreContent.SetHtmlContent(list);
         }
 
         protected virtual void SetOneItemAsActive(TagHelperContext context, TagHelperOutput output, List<CarouselItem> itemList)

framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap/TagHelpers/Collapse/AbpAccordionItemTagHelperService.cs

@@ -1,7 +1,8 @@
-using System;
+using Microsoft.AspNetCore.Mvc.Rendering;
+using Microsoft.AspNetCore.Razor.TagHelpers;
+using System;
 using System.Collections.Generic;
 using System.Threading.Tasks;
-using Microsoft.AspNetCore.Razor.TagHelpers;
 using Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Extensions;
 
 namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Collapse
@@ -17,7 +18,6 @@ namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Collapse
             var html = GetAccordionHeaderItem(context, output) + GetAccordionContentItem(context, output, innerContent);
 
             var tabHeaderItems = context.GetValue<List<string>>(AccordionItems);
-
             tabHeaderItems.Add(html);
 
             output.SuppressOutput();
@@ -25,23 +25,43 @@ namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Collapse
 
         protected virtual string GetAccordionHeaderItem(TagHelperContext context, TagHelperOutput output)
         {
-            return "     <div class=\"card-header\" id=\"" + GetHeadingId() + "\">" + Environment.NewLine +
-                   "      <h5 class=\"mb-0\">" + Environment.NewLine +
-                   "        <button class=\"btn btn-link\" type=\"button\" data-toggle=\"collapse\" data-target=\"#" + GetContentId() + "\" aria-expanded=\"true\" aria-controls=\"" + GetContentId() + "\">" + Environment.NewLine +
-                                    TagHelper.Title + Environment.NewLine +
-                   "        </button>" + Environment.NewLine +
-                   "      </h5>" + Environment.NewLine +
-                   "    </div>" + Environment.NewLine;
+            var button = new TagBuilder("button");
+            button.AddCssClass("btn btn-link");
+            button.Attributes.Add("type", "button");
+            button.Attributes.Add("data-toggle", "collapse");
+            button.Attributes.Add("data-target", "#" + GetContentId());
+            button.Attributes.Add("aria-expanded", "true");
+            button.Attributes.Add("aria-controls", GetContentId());
+            button.InnerHtml.Append(TagHelper.Title);
+
+            var h5 = new TagBuilder("h5");
+            h5.AddCssClass("mb-0");
+            h5.InnerHtml.AppendHtml(button);
+
+            var header = new TagBuilder("div");
+            header.AddCssClass("card-header");
+            header.Attributes.Add("id", GetHeadingId());
+            header.InnerHtml.AppendHtml(h5);
+
+            return RenderHtml(header);
         }
 
         protected virtual string GetAccordionContentItem(TagHelperContext context, TagHelperOutput output, string content)
         {
             var show = (TagHelper.Active ?? false) ? " show" : "";
-            return "<div id=\"" + GetContentId() + "\" class=\"collapse"+ show + "\" aria-labelledby=\"" + GetHeadingId() + "\" data-parent=\"#" + AbpAccordionParentIdPlaceholder + "\">" + Environment.NewLine +
-                   "      <div class=\"card-body\">" + Environment.NewLine +
-                            content + Environment.NewLine +
-                   "      </div>" + Environment.NewLine +
-                   "</div>" + Environment.NewLine;
+
+            var cardBody = new TagBuilder("div");
+            cardBody.AddCssClass("card-body");
+            cardBody.InnerHtml.AppendHtml(content);
+
+            var wrapper = new TagBuilder("div");
+            wrapper.AddCssClass("collapse" + show);
+            wrapper.Attributes.Add("id", GetContentId());
+            wrapper.Attributes.Add("aria-labelledby", GetHeadingId());
+            wrapper.Attributes.Add("data-parent", "#" + AbpAccordionParentIdPlaceholder);
+            wrapper.InnerHtml.AppendHtml(cardBody);
+
+            return RenderHtml(wrapper);
         }
 
         protected virtual string GetHeadingId()

framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap/TagHelpers/Collapse/AbpAccordionTagHelperService.cs

@@ -1,14 +1,22 @@
-using System;
+using Microsoft.AspNetCore.Mvc.ViewFeatures;
+using Microsoft.AspNetCore.Razor.TagHelpers;
+using System;
 using System.Collections.Generic;
 using System.Text;
 using System.Threading.Tasks;
-using Microsoft.AspNetCore.Razor.TagHelpers;
 using Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.Microsoft.AspNetCore.Razor.TagHelpers;
 
 namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Collapse
 {
     public class AbpAccordionTagHelperService : AbpTagHelperService<AbpAccordionTagHelper>
     {
+        protected IHtmlGenerator HtmlGenerator { get; }
+
+        public AbpAccordionTagHelperService(IHtmlGenerator htmlGenerator)
+        {
+            HtmlGenerator = htmlGenerator;
+        }
+
         public override async Task ProcessAsync(TagHelperContext context, TagHelperOutput output)
         {
             SetRandomIdIfNotProvided();
@@ -32,7 +40,7 @@ namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Collapse
             var html = new StringBuilder("");
             foreach (var item in items)
             {
-                var content = item.Replace(AbpAccordionParentIdPlaceholder, TagHelper.Id);
+                var content = item.Replace(AbpAccordionParentIdPlaceholder, HtmlGenerator.Encode(TagHelper.Id));
 
                 html.AppendLine(
                     "<div class=\"card\">" + Environment.NewLine + 

framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap/TagHelpers/Modal/AbpModalFooterTagHelperService.cs

@@ -1,10 +1,10 @@
-using System.Text;
-using Localization.Resources.AbpUi;
+using Localization.Resources.AbpUi;
+using Microsoft.AspNetCore.Mvc.Rendering;
 using Microsoft.AspNetCore.Razor.TagHelpers;
 using Microsoft.Extensions.Localization;
 using Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.Microsoft.AspNetCore.Razor.TagHelpers;
 
-namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Modal
+namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Modal
 {
     public class AbpModalFooterTagHelperService : AbpTagHelperService<AbpModalFooterTagHelper>
     {
@@ -22,37 +22,78 @@ namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Modal
 
             if (TagHelper.Buttons != AbpModalButtons.None)
             {
-                output.PostContent.SetHtmlContent(CreateContent());
+                ProcessButtons(context, output);
             }
-            ProcessButtonsAlignment(output);
-        }
-
-        protected virtual string CreateContent()
-        {
-            var sb = new StringBuilder();
 
-            switch (TagHelper.Buttons)
-            {
+            ProcessButtonsAlignment(output);
+        }
+
+        protected virtual void ProcessButtons(TagHelperContext context, TagHelperOutput output) 
+        {
+            switch (TagHelper.Buttons) 
+            {
                 case AbpModalButtons.Cancel:
-                    sb.AppendLine("<button type=\"button\" class=\"btn btn-secondary\" data-dismiss=\"modal\">" + _localizer["Cancel"] + "</button>");
+                    output.PostContent.AppendHtml(GetCancelButton());
                     break;
                 case AbpModalButtons.Close:
-                    sb.AppendLine("<button type=\"button\" class=\"btn btn-secondary\" data-dismiss=\"modal\">" + _localizer["Close"] + "</button>");
+                    output.PostContent.AppendHtml(GetCloseButton());
                     break;
                 case AbpModalButtons.Save:
-                    sb.AppendLine("<button type=\"submit\" class=\"btn btn-primary\" data-busy-text=\"" + _localizer["SavingWithThreeDot"] + "\"><i class=\"fa fa-check\"></i> <span>" + _localizer["Save"] + "</span></button>");
+                    output.PostContent.AppendHtml(GetSaveButton());
                     break;
                 case AbpModalButtons.Save | AbpModalButtons.Cancel:
-                    sb.AppendLine("<button type=\"button\" class=\"btn btn-secondary\" data-dismiss=\"modal\">" + _localizer["Cancel"] + "</button>");
-                    sb.AppendLine("<button type=\"submit\" class=\"btn btn-primary\" data-busy-text=\"" + _localizer["SavingWithThreeDot"] + "\"><i class=\"fa fa-check\"></i> <span>" + _localizer["Save"] + "</span></button>");
+                    output.PostContent.AppendHtml(GetSaveButton());
+                    output.PostContent.AppendHtml(GetCancelButton());
                     break;
                 case AbpModalButtons.Save | AbpModalButtons.Close:
-                    sb.AppendLine("<button type=\"button\" class=\"btn btn-secondary\" data-dismiss=\"modal\">" + _localizer["Close"] + "</button>");
-                    sb.AppendLine("<button type=\"submit\" class=\"btn btn-primary\" data-busy-text=\"" + _localizer["SavingWithThreeDot"] + "\"><i class=\"fa fa-check\"></i> <span>" + _localizer["Save"] + "</span></button>");
-                    break;
+                    output.PostContent.AppendHtml(GetSaveButton());
+                    output.PostContent.AppendHtml(GetCloseButton());
+                    break;
             }
+        }
+
+        protected virtual string GetSaveButton() 
+        {
+            var icon = new TagBuilder("i");
+            icon.AddCssClass("fa");
+            icon.AddCssClass("fa-check");
+
+            var span = new TagBuilder("span");
+            span.InnerHtml.Append(_localizer["Save"]);
+
+            var button = new TagBuilder("button");
+            button.Attributes.Add("type", "submit");
+            button.AddCssClass("btn");
+            button.AddCssClass("btn-primary");
+            button.Attributes.Add("data-busy-text", _localizer["SavingWithThreeDot"]);
+            button.InnerHtml.AppendHtml(icon);
+            button.InnerHtml.AppendHtml(span);
+
+            return RenderHtml(button);
+        }
+
+        protected virtual string GetCloseButton() 
+        {
+            var button = new TagBuilder("button");
+            button.Attributes.Add("type", "button");
+            button.Attributes.Add("data-dismiss", "modal");
+            button.AddCssClass("btn");
+            button.AddCssClass("btn-secondary");
+            button.InnerHtml.Append(_localizer["Close"]);
+
+            return RenderHtml(button);
+        }
+
+        protected virtual string GetCancelButton() 
+        {
+            var button = new TagBuilder("button");
+            button.Attributes.Add("type", "button");
+            button.Attributes.Add("data-dismiss", "modal");
+            button.AddCssClass("btn");
+            button.AddCssClass("btn-secondary");
+            button.InnerHtml.Append(_localizer["Cancel"]);
 
-            return sb.ToString();
+            return RenderHtml(button);
         }
 
         protected virtual void ProcessButtonsAlignment(TagHelperOutput output)

framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap/TagHelpers/Modal/AbpModalHeaderTagHelperService.cs

@@ -1,5 +1,6 @@
-using System.Text;
+using Microsoft.AspNetCore.Mvc.Rendering;
 using Microsoft.AspNetCore.Razor.TagHelpers;
+using System.Text;
 using Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.Microsoft.AspNetCore.Razor.TagHelpers;
 
 namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Modal
@@ -16,11 +17,11 @@ namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Modal
 
         protected virtual string CreatePreContent()
         {
-            var sb = new StringBuilder();
-
-            sb.AppendLine("    <h5 class=\"modal-title\">" + TagHelper.Title + "</h5>");
+            var title = new TagBuilder("h5");
+            title.AddCssClass("modal-title");
+            title.InnerHtml.Append(TagHelper.Title);
 
-            return sb.ToString();
+            return RenderHtml(title);
         }
 
         protected virtual string CreatePostContent()

framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap/TagHelpers/Modal/AbpModalTagHelperService.cs

@@ -1,11 +1,19 @@
-using System.Linq;
-using System.Text;
+using Microsoft.AspNetCore.Mvc.ViewFeatures;
 using Microsoft.AspNetCore.Razor.TagHelpers;
+using System.Linq;
+using System.Text;
 
 namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Modal
 {
     public class AbpModalTagHelperService : AbpTagHelperService<AbpModalTagHelper>
-    {
+    {
+        protected IHtmlGenerator HtmlGenerator { get; }
+
+        public AbpModalTagHelperService(IHtmlGenerator htmlGenerator)
+        {
+            HtmlGenerator = htmlGenerator;
+        }
+
         public override void Process(TagHelperContext context, TagHelperOutput output)
         {
             output.TagName = null;
@@ -17,7 +25,7 @@ namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Modal
         {
             var sb = new StringBuilder();
 
-            var attritubutes = output.Attributes.Select(a => " " + a.Name + "=\"" + a.Value + "\" ").ToList();
+            var attritubutes = output.Attributes.Select(a => " " + HtmlGenerator.Encode(a.Name) + "=\"" + HtmlGenerator.Encode(a.Value) + "\" ").ToList();
             var attritubutesAsJoin = string.Join(" ", attritubutes.ToArray());
 
             sb.AppendLine("<div class=\"" + GetModalClasses() + "\" tabindex=\"-1\" role=\"dialog\" aria-hidden=\"true\" " + attritubutesAsJoin + GetDataAttributes() + ">");

framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap/TagHelpers/Nav/AbpNavbarToggleTagHelperService.cs

@@ -1,11 +1,21 @@
-using System;
+using Localization.Resources.AbpUi;
+using Microsoft.AspNetCore.Mvc.Rendering;
 using Microsoft.AspNetCore.Razor.TagHelpers;
+using Microsoft.Extensions.Localization;
+using System;
 using Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.Microsoft.AspNetCore.Razor.TagHelpers;
 
 namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Nav
 {
     public class AbpNavbarToggleTagHelperService : AbpTagHelperService<AbpNavbarToggleTagHelper>
     {
+        protected IStringLocalizer<AbpUiResource> L { get; }
+
+        public AbpNavbarToggleTagHelperService(IStringLocalizer<AbpUiResource> stringLocalizer)
+        {
+            L = stringLocalizer;
+        }
+
         public override void Process(TagHelperContext context, TagHelperOutput output)
         {
             SetRandomNameIfNotProvided();
@@ -18,10 +28,20 @@ namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Nav
 
         protected virtual void SetToggleButton(TagHelperContext context, TagHelperOutput output)
         {
-            output.PreElement.SetHtmlContent(
-                "<button class=\"navbar-toggler\" type=\"button\" data-toggle=\"collapse\" data-target=\"#" +
-                TagHelper.Id + "\" aria-controls=\"" + TagHelper.Id +
-                "\" aria-expanded=\"false\" aria-label=\"Toggle navigation\">\r\n    <span class=\"navbar-toggler-icon\"></span>\r\n  </button>");
+            var span = new TagBuilder("span");
+            span.AddCssClass("navbar-toggler-icon");
+
+            var button = new TagBuilder("button");
+            button.AddCssClass("navbar-toggler");
+            button.Attributes.Add("type", "button");
+            button.Attributes.Add("data-toggle", "collapse");
+            button.Attributes.Add("data-target", "#" + TagHelper.Id);
+            button.Attributes.Add("aria-controls", TagHelper.Id);
+            button.Attributes.Add("aria-expanded", "false");
+            button.Attributes.Add("aria-label", L["ToggleNavigation"].Value);
+            button.InnerHtml.AppendHtml(span);
+
+            output.PreElement.SetHtmlContent(button);
         }
 
         protected virtual void SetRandomNameIfNotProvided()

framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap/TagHelpers/Pagination/AbpPaginationTagHelperService.cs

@@ -1,13 +1,13 @@
-using System;
-using System.Linq;
-using System.Text;
-using System.Text.Encodings.Web;
-using System.Threading.Tasks;
-using Localization.Resources.AbpUi;
+using Localization.Resources.AbpUi;
 using Microsoft.AspNetCore.Mvc.TagHelpers;
 using Microsoft.AspNetCore.Mvc.ViewFeatures;
 using Microsoft.AspNetCore.Razor.TagHelpers;
 using Microsoft.Extensions.Localization;
+using System;
+using System.Linq;
+using System.Text;
+using System.Text.Encodings.Web;
+using System.Threading.Tasks;
 using Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.Microsoft.AspNetCore.Razor.TagHelpers;
 using Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Extensions;
 
@@ -134,7 +134,7 @@ namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Pagination
 
             SetHrefAttribute(currentPage, attributeList);
 
-            tagHelperOutput.Content.SetHtmlContent(localizer[localizationKey]);
+            tagHelperOutput.Content.SetContent(localizer[localizationKey]);
 
             var renderedHtml = tagHelperOutput.Render(_encoder);
 
@@ -166,7 +166,7 @@ namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Pagination
             var localizer = _stringLocalizerFactory.Create(typeof(AbpUiResource));
 
             var pagerInfo = (TagHelper.ShowInfo ?? false) ?
-                "    <div class=\"col-sm-12 col-md-5\"> " + localizer["PagerInfo{0}{1}{2}", TagHelper.Model.ShowingFrom, TagHelper.Model.ShowingTo, TagHelper.Model.TotalItemsCount] + "</div>\r\n"
+                "    <div class=\"col-sm-12 col-md-5\"> " + _encoder.Encode(localizer["PagerInfo{0}{1}{2}", TagHelper.Model.ShowingFrom, TagHelper.Model.ShowingTo, TagHelper.Model.TotalItemsCount]) + "</div>\r\n"
                 : "";
 
             return

framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap/TagHelpers/Popover/AbpPopoverTagHelperService.cs

@@ -1,11 +1,18 @@
-using System;
-using System.Linq;
+using Microsoft.AspNetCore.Mvc.ViewFeatures;
 using Microsoft.AspNetCore.Razor.TagHelpers;
+using System.Linq;
 
 namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Popover
 {
     public class AbpPopoverTagHelperService : AbpTagHelperService<AbpPopoverTagHelper>
-    {
+    {
+        protected IHtmlGenerator HtmlGenerator { get; }
+
+        public AbpPopoverTagHelperService(IHtmlGenerator htmlGenerator)
+        {
+            HtmlGenerator = htmlGenerator;
+        }
+
         public override void Process(TagHelperContext context, TagHelperOutput output)
         {
             if (!TagHelper.Disabled ?? true)
@@ -44,8 +51,8 @@ namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Popover
                 dataPlacementAsHtml = dataPlacementAsHtml.Replace("default", "top");
             }
             var titleAttribute = output.Attributes.FirstOrDefault(at => at.Name == "title");
-            var titleAsHtml = titleAttribute == null ? "" : "title=\"" + titleAttribute.Value + "\" ";
-            var preElementHtml = "<span tabindex=\"0\" class=\"d-inline-block\" " + titleAsHtml + triggerAsHtml + dataPlacementAsHtml + "data-toggle=\"popover\" data-content=\"" + GetDataContent() + "\">";
+            var titleAsHtml = titleAttribute == null ? "" : "title=\"" + HtmlGenerator.Encode(titleAttribute.Value) + "\" ";
+            var preElementHtml = "<span tabindex=\"0\" class=\"d-inline-block\" " + titleAsHtml + triggerAsHtml + dataPlacementAsHtml + "data-toggle=\"popover\" data-content=\"" + HtmlGenerator.Encode(GetDataContent()) + "\">";
             var postElementHtml = "</span>";
 
             output.PreElement.SetHtmlContent(preElementHtml);

framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap/TagHelpers/Tab/AbpTabDropdownTagHelperService.cs

@@ -1,7 +1,8 @@
-using System;
+using Microsoft.AspNetCore.Mvc.Rendering;
+using Microsoft.AspNetCore.Razor.TagHelpers;
+using System;
 using System.Collections.Generic;
 using System.Threading.Tasks;
-using Microsoft.AspNetCore.Razor.TagHelpers;
 using Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Extensions;
 
 namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Tab
@@ -31,14 +32,26 @@ namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Tab
             var link = TagHelper.Name;
             var title = TagHelper.Title;
 
-            return "<li class=\"nav-item dropdown\">" +
-                   "<a class=\"nav-link dropdown-toggle\" id=\"" + id + "\" data-toggle=\"dropdown\" href=\"#" + link + "\" role=\"button\" aria-haspopup=\"true\" aria-expanded=\"false\">" +
-                   title +
-                   "</a>" +
-                   "<div class=\"dropdown-menu\">" +
-                   AbpTabDropdownItemsActivePlaceholder +
-                   "</div>" +
-                   "</li>";
+            var anchor = new TagBuilder("a");
+            anchor.AddCssClass("nav-link dropdown-toggle");
+            anchor.Attributes.Add("id", id);
+            anchor.Attributes.Add("data-toggle", "dropdown");
+            anchor.Attributes.Add("href", "#" + link);
+            anchor.Attributes.Add("role", "button");
+            anchor.Attributes.Add("aria-haspopup", "true");
+            anchor.Attributes.Add("aria-expanded", "false");
+            anchor.InnerHtml.Append(title);
+
+            var menu = new TagBuilder("div");
+            menu.AddCssClass("dropdown-menu");
+            menu.InnerHtml.Append(AbpTabDropdownItemsActivePlaceholder);
+
+            var listItem = new TagBuilder("li");
+            listItem.AddCssClass("nav-item dropdown");
+            listItem.InnerHtml.AppendHtml(anchor);
+            listItem.InnerHtml.AppendHtml(menu);
+
+            return RenderHtml(listItem);
         }
     }
 }

framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap/TagHelpers/Tab/AbpTabLinkTagHelperService.cs

@@ -1,6 +1,7 @@
-using System.Collections.Generic;
-using System.Threading.Tasks;
+using Microsoft.AspNetCore.Mvc.Rendering;
 using Microsoft.AspNetCore.Razor.TagHelpers;
+using System.Collections.Generic;
+using System.Threading.Tasks;
 using Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Extensions;
 
 namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Tab
@@ -30,12 +31,28 @@ namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Tab
 
             if (!string.IsNullOrWhiteSpace(TagHelper.ParentDropdownName))
             {
-                return "<a class=\"dropdown-item\" id=\"" + id + "\" href=\"" + href + "\">" + title + "</a>";
+                var anchor = new TagBuilder("a");
+                anchor.AddCssClass("dropdown-item");
+                anchor.Attributes.Add("id", id);
+                anchor.Attributes.Add("href", href);
+                anchor.InnerHtml.Append(title);
+
+                return RenderHtml(anchor);
             }
+            else
+            {
+                var anchor = new TagBuilder("a");
+                anchor.AddCssClass("nav-link " + AbpTabItemActivePlaceholder);
+                anchor.Attributes.Add("id", id);
+                anchor.Attributes.Add("href", href);
+                anchor.InnerHtml.Append(title);
+
+                var listItem = new TagBuilder("li");
+                listItem.AddCssClass("nav-item");
+                listItem.InnerHtml.AppendHtml(anchor);
 
-            return "<li class=\"nav-item\"><a class=\"nav-link" + AbpTabItemActivePlaceholder + "\" id=\"" + id + "\" href=\"" + href + "\">" +
-                   title +
-                   "</a></li>";
+                return RenderHtml(listItem);
+            }
         }
 
         protected virtual void SetPlaceholderForNameIfNotProvided()

framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap/TagHelpers/Tab/AbpTabTagHelperService.cs

@@ -1,7 +1,8 @@
-using System.Collections.Generic;
+using Microsoft.AspNetCore.Mvc.Rendering;
+using Microsoft.AspNetCore.Razor.TagHelpers;
+using System.Collections.Generic;
 using System.Linq;
 using System.Threading.Tasks;
-using Microsoft.AspNetCore.Razor.TagHelpers;
 using Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Extensions;
 
 namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Tab
@@ -34,16 +35,52 @@ namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Tab
             var attributes = GetTabHeaderAttributes(context, output);
 
             var classAttributesAsString = attributes.Where(a=>a.Name == "class").ToList().Select(a=>a.Value).JoinAsString(" ");
-            var otherAttributesAsString = attributes.Where(a => a.Name != "class").ToList().ToHtmlAttributesAsString();
+            var otherAttributes = attributes.Where(a => a.Name != "class").ToList();
 
             if (!string.IsNullOrWhiteSpace(TagHelper.ParentDropdownName))
             {
-                return "<a class=\"dropdown-item "+ classAttributesAsString + "\" id=\"" + id + "\" href=\"#" + link + "\" data-toggle=\"tab\"  role=\"tab\" aria-controls=\"" + control + "\" aria-selected=\"false\" "+ otherAttributesAsString + ">" + title + "</a>";
+                var anchor = new TagBuilder("a");
+                anchor.AddCssClass("dropdown-item " + classAttributesAsString);
+                anchor.Attributes.Add("id", id);
+                anchor.Attributes.Add("href", "#" + link);
+                anchor.Attributes.Add("data-toggle", "tab");
+                anchor.Attributes.Add("role", "tab");
+                anchor.Attributes.Add("aria-controls", control);
+                anchor.Attributes.Add("aria-selected", "false");
+
+                foreach (var attr in otherAttributes)
+                {
+                    anchor.Attributes.Add(attr.Name, attr.Value.ToString());
+                }
+
+                anchor.InnerHtml.Append(title);
+
+                return RenderHtml(anchor);
+            }
+            else
+            {
+                var anchor = new TagBuilder("a");
+                anchor.AddCssClass("nav-link " + classAttributesAsString + " " + AbpTabItemActivePlaceholder);
+                anchor.Attributes.Add("id", id);
+                anchor.Attributes.Add("data-toggle", TabItemsDataTogglePlaceHolder);
+                anchor.Attributes.Add("href", "#" + link);
+                anchor.Attributes.Add("role", "tab");
+                anchor.Attributes.Add("aria-controls", control);
+                anchor.Attributes.Add("aria-selected", AbpTabItemSelectedPlaceholder);
+
+                foreach (var attr in otherAttributes)
+                {
+                    anchor.Attributes.Add(attr.Name, attr.Value.ToString());
+                }
+
+                anchor.InnerHtml.Append(title);
+
+                var listItem = new TagBuilder("li");
+                listItem.AddCssClass("nav-item");
+                listItem.InnerHtml.AppendHtml(anchor);
+
+                return RenderHtml(listItem);
             }
-
-            return "<li class=\"nav-item\"><a class=\"nav-link " + classAttributesAsString + " " + AbpTabItemActivePlaceholder + "\" id=\"" + id + "\" data-toggle=\"" + TabItemsDataTogglePlaceHolder + "\" href=\"#" + link + "\" role=\"tab\" aria-controls=\"" + control + "\" aria-selected=\"" + AbpTabItemSelectedPlaceholder + "\" "+ otherAttributesAsString + ">" +
-                   title +
-                   "</a></li>";
         }
 
         protected virtual string GetTabContentItem(TagHelperContext context, TagHelperOutput output, string content)
@@ -53,11 +90,22 @@ namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Tab
             var attributes = GetTabContentAttributes(context, output);
 
             var classAttributesAsString = attributes.Where(a => a.Name == "class").ToList().Select(a => a.Name).JoinAsString(" ");
-            var otherAttributesAsString = attributes.Where(a => a.Name != "class").ToList().ToHtmlAttributesAsString();
+            var otherAttributes = attributes.Where(a => a.Name != "class").ToList();
+
+            var wrapper = new TagBuilder("div");
+            wrapper.AddCssClass("tab-pane fade " + classAttributesAsString + " " + AbpTabItemShowActivePlaceholder);
+            wrapper.Attributes.Add("id", id);
+            wrapper.Attributes.Add("role", "tabpanel");
+            wrapper.Attributes.Add("aria-labelledby", headerId);
+
+            foreach (var attr in otherAttributes)
+            {
+                wrapper.Attributes.Add(attr.Name, attr.Value.ToString());
+            }
+
+            wrapper.InnerHtml.AppendHtml(content);
 
-            return "<div class=\"tab-pane fade " + classAttributesAsString + " " + AbpTabItemShowActivePlaceholder + "\" id=\"" + id + "\" role=\"tabpanel\" aria-labelledby=\"" + headerId + "\" " + otherAttributesAsString + ">" +
-                   content +
-                   "</div>";
+            return RenderHtml(wrapper);
         }
 
         protected virtual void SetPlaceholderForNameIfNotProvided()

framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap/TagHelpers/Tooltip/AbpTooltipTagHelperService.cs

@@ -1,11 +1,19 @@
 using System;
 using System.Linq;
+using Microsoft.AspNetCore.Mvc.ViewFeatures;
 using Microsoft.AspNetCore.Razor.TagHelpers;
 
 namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Tooltip
 {
     public class AbpTooltipTagHelperService : AbpTagHelperService<AbpTooltipTagHelper>
     {
+        protected IHtmlGenerator HtmlGenerator { get; }
+
+        public AbpTooltipTagHelperService(IHtmlGenerator htmlGenerator)
+        {
+            HtmlGenerator = htmlGenerator;
+        }
+
         public override void Process(TagHelperContext context, TagHelperOutput output)
         {
             if (IsButtonDisabled(context, output))
@@ -26,8 +34,8 @@ namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Tooltip
 
             output.PreElement.SetHtmlContent(
                 "<span class=\"d-inline-block\" tabindex=\"0\" data-toggle=\"tooltip\" " +
-                "data-placement=\"" + directory.ToString().ToLowerInvariant() +
-                "\" title=\"" + GetTitle() + "\">" + Environment.NewLine);
+                "data-placement=\"" + HtmlGenerator.Encode(directory.ToString().ToLowerInvariant()) +
+                "\" title=\"" + HtmlGenerator.Encode(GetTitle()) + "\">" + Environment.NewLine);
 
             output.PostElement.SetHtmlContent(Environment.NewLine + "</span>");