Gotcha: use server-side comment, not HTML comment in ASP.net

I try to remember to use <%– and –%> instead of <!– and –> for comments in server-side web pages, to avoid having implementation details (for security reasons that is) in the output HTML and to keep the download size smaller / have the pages load faster.

What came to me though the other day while making some metadata editing pages for ClipFlair Gallery, was that if you don’t use server-side comments and use classic HTML comments in server-side pages, the code inside the HTML comments is executed at the server side and its output is placed in HTML comments at the web page the client browser downloads.

So this can potentially lead to a very big download and to increased time to generate the page at the sever-side if you accidentally comment out some code block you were using for testing and don’t use server-side comments, but use HTML comments instead to comment it out.

What got me into suspission was the syntax highlighting of Visual Studio 2010. Note below that <%@ Register isn’t highlighted green (as it would be in a server-side comment).

<%@ Page Language="C#" 
         AutoEventWireup="true"
         Title="ClipFlair Activity Gallery"
%>

<!-- THIS IS A BAD USE OF HTML COMMENT MARKER, USE SERVER-SIDE COMMENT INSTEAD

<%@ Register Assembly="CustomXml" Namespace="PAB.WebControls" TagPrefix="cc2" %>

<cc2:CustomXml 
  DocumentUrl="http://gallery.clipflair.net/activity/all.xml"
  XslUrl="http://gallery.clipflair.net/activity/activity.xsl"
  runat="server"
  />

-->

...

Probably JavaEE’s JSP behaves similarly (uses the same symbols for server-side comments), but haven’t tested it.