yes @scheien, I have read this article http://www.codeguru.com/csharp/.net/net_asp/preventing-cross-site-scripting-attacks-in-asp.net-mvc-4.htm
and i found that we can avoid xss attack by using <%= values %> closing and opening brackets.
but, the suggestion is different in this post. that is we should use `:` instead of `=`.
http://www.dotnetfunda.com/interviews/show/5750/how-to-avoid-xss-vulnerabilities-in-aspnet-mvc