C# String.Format - Invalid input string

Question

I have a MVC3 HtmlHelper extension like this:

public static MvcHtmlString ShowInfoBar(this HtmlHelper helper, string message, InfoMessageType messageType)
    {
        return MvcHtmlString.Create(String.Format(@"<script type=""text/javascript"">$(document).ready(function () { gtg.core.showInfoBar('{0}', '{1}'}; );</script>", message, messageType.ToString().ToLower()));
    }

The value of message is "The product "Product Name" was saved successfully."

The value of messageType is info.

It keeps saying Input string was not in the correct format.

I am stuck??

Is there an error if you just enter the string without using the String.Format() method on it? — Edward Black
– Edward Black, Commented Aug 17, 2011 at 17:55

Marc Gravell · Accepted Answer · 2011-08-17 17:54:56Z

21

On every brace that isn't a token you must double - so

function() {{

Etc

Also - consider XSS here - is message escaped correctly for inserting into JavaScript?

answered Aug 17, 2011 at 17:54

Marc Gravell

1.1m273 gold badges2.6k silver badges3k bronze badges

Sign up to request clarification or add additional context in comments.

10 Comments

Sam Over a year ago

Could you point me somewhere to learn about this a little more? Thanks!

Marc Gravell Over a year ago

Which, XSS? Anywhere. Wikipedia would be a start. All you'd need is a ' message " with ' quotes " in to test it (although full escaping is more than just quotes)

Adam Porad Over a year ago

Excellent mention of whether the method parameter is escaped for JavaScript correctly.

Marc Gravell Over a year ago

@Sam right; so currently it is broken. Now imagine that I carefully created a product name like '); stealYourCookiesAndPostThemSomewhere(); // - and I've hacked your login - hence XSS. The simplest option is to write the data to a hidden element somewhere and read it out. Another option is to use something like JavascriptSerializer to write JSON (which will then be escaped). A plain JSON escape would be welcome, too.

Marc Gravell Over a year ago

@Sam it all depends on context of course - you could argue that simply not being able to correctly handle O'Neills' biscuits is enough of a bug. But also don't underestimate the amount of evil committed internally to an organisation (especially shortly after a bad pay review, etc) - it isn't just the unwashed public that are capable of doing harm.

|

dtb · Accepted Answer · 2011-08-17 17:56:29Z

10

Escape your squiggly brackets {{ }} in the format string

String.Format(@"<script type=""text/javascript"">$(document).ready(function () {{ gtg.core.showInfoBar('{0}', '{1}'); }});</script>", message, messageType.ToString().ToLower())

edited Aug 17, 2011 at 17:56

dtb

218k37 gold badges413 silver badges438 bronze badges

answered Aug 17, 2011 at 17:53

Louis Ricci

21.1k5 gold badges50 silver badges64 bronze badges

Comments

Mrchief · Accepted Answer · 2011-08-17 17:53:05Z

5

You need to escape the curly braces:

{{ and }}

String.Format(@"<script type=""text/javascript"">$(document).ready(function () {{ gtg.core.showInfoBar('{0}', '{1}'}}; );</script>", 
              message, messageType.ToString().ToLower())

answered Aug 17, 2011 at 17:53

Mrchief

76.4k20 gold badges145 silver badges193 bronze badges

Comments

Noldy · Accepted Answer · 2013-02-27 12:32:35Z

1

In my case I used the bracket for JsonP formatting. JsonP requires a '{' too. By escaping the { like this: '{{', my problem was solved.

answered Feb 27, 2013 at 12:32

Noldy

5905 silver badges10 bronze badges

Comments

Hari Prasad · Accepted Answer · 2015-06-17 04:20:13Z

0

I have tried as below, and its working.

string.Format(@"ExecuteOrDelayUntilScriptLoaded(function () {{ Your function.

edited Jun 17, 2015 at 4:20

Hari Prasad

17k4 gold badges23 silver badges35 bronze badges

answered Jun 17, 2015 at 3:58

Pavan Kumar

363 bronze badges

Collectives™ on Stack Overflow

C# String.Format - Invalid input string

5 Answers 5

10 Comments

Comments

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

10 Comments

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related