Since .NET 2.0 Asp.net webforms has protected the programmer from cross-site scripting by validating all input sent to the server. Unfortunately, this does not happen in Asp.net mvc. I tested my application by typing 'alert("xss");' surrounded by script tags in the first name textbox. The form saved successfully and I got a javascript alert box with the message "xss".
In asp.net mvc it is the programmers responsibility to validate all input. Calling Request.ValidateInput() in a controller tells the framework that any values read from the request should be validated. If an invalid character is found a HttpRequestValidationException is thrown.
Here is an example implementation:
Request.ValidateInput();
try { UpdateModel(b, new[] { "FirstName", "LastName", "Email" }); }
catch (HttpRequestValidationException) { /* Handle request validation error */ }