Sanitization of input?

Model binding does not sanitize input — it binds raw data.

🛡 To prevent attacks (XSS, injection), sanitize:

• Strings: HTML encode output (@Html.Encode)
• Manually clean input before use
• Use antivirus/malware scanners for uploaded files