Image.FromFile非常慢。(Image.FromFile is very SLOW. Any alternatives, optimizations?)

 理论上，编码客户端不会比编码服务器端更危险。 确保其安全的关键在于如何在呈现数据的所有位置放置合适的编码。 您当然可以在客户端和服务器端安全地创建用于提交用户提交数据的良好实现。 实际上，实现输出编码客户端的一个缺点是潜在的攻击者可以轻松检查您的源代码是否存在缺陷。 这意味着如果客户端编码实现中存在缺陷，那么比服务器端更容易找到（假设是封闭的源系统）。 如果你正在开发开源软件，那么这一点是没有意义的。 
 
 同样如你所说，修改你的客户端编码代码的攻击者是一个没有问题的人，因为他们只会修改他们自己的代码副本而不会影响其他访问者。 
 
 海事组织，让客户端处理编码实际上更清洁，特别是如果您正在开发一个由Web和本地移动应用程序共享的API。 您不希望移动应用程序必须将HTML编码值转换回原始格式。 

In theory, encoding client-side is no more dangerous than encoding server-side. The key to making it secure really is in how rigourous you are in putting suitable encoding in all the places which renders your data. You can certainly create a good implementation for rendering user submitted data safely on client and server sides. Practically though, a drawback of implementing output encoding client side is that a potential attacker can easily examine your source code for flaws. This means that if there are bugs in your client-side encoding implementation, it will be easier to find than say on the server-side (assuming a closed source system). If you are developing open source software, then this point is moot.
 
Also as you said, an attacker modifying your client-side encoding code is a non-issue as they will only be modifying their own copy of the code and will not affect other visitors.
 
IMO it is actually cleaner to let the client handle encoding especially if you are developing an API which is shared by web and native mobile applications. You don't want your mobile application to have to convert HTML encoded values back to it's original form.