How to convert string to HTML safe string

Question

I am creating a some dynamically generated HTML

bldr.AppendLine("<a>");
string userText = user.Company;
bldr.AppendLine(userText);
bldr.AppendLine("</a>");

How can I ensure that whatever the company's name is, will appear as it should, but also if they try to inject any HTML in thier name it will simply appear in plain text.

For instance if they tried to use the name "<script>alert("Do Bad!")</script>" that's exactly what will appear on the page, in plain text.

But I also want to avoid "A & C" translating to "A \u0026 C", which is what happens when I use

HttpUtility.JavaScriptStringEncode(user.Company);

Felipe Oriani · Accepted Answer · 2014-05-21 12:52:40Z

28

You can use the same class HttpUtility you have use to javascript, but, for html, for sample:

bldr.AppendFormat("<a>{0}</a>\n", HttpUtility.HtmlEncode(user.Company));

There is also the inverse way using HttpUtility.HtmlDecode(string).

answered May 21, 2014 at 12:52

Felipe Oriani

38.7k20 gold badges141 silver badges203 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

MarkO · Accepted Answer · 2014-05-21 12:54:46Z

18

An alternative without a dependency to System.Web:

System.Net.WebUtility.HtmlEncode()

answered May 21, 2014 at 12:54

MarkO

2,25313 silver badges14 bronze badges

1 Comment

Skyfish Over a year ago

This encodes characters as HTML entities, e.g. "&" becomes "&"

Manfre · Accepted Answer · 2014-05-21 12:52:06Z

10

using System.Web;

var encoded = HttpUtility.HtmlEncode(unencoded);

answered May 21, 2014 at 12:52

Manfre

1,24510 silver badges11 bronze badges

Comments

Christoph Fink · Accepted Answer · 2014-05-21 12:51:40Z

5

You can use the HttpUtility.HtmlEncode method:

var htmlString = HttpUtility.HtmlEncode(user.Company);

answered May 21, 2014 at 12:51

Christoph Fink

23.2k9 gold badges72 silver badges118 bronze badges

Comments

Rik · Accepted Answer · 2014-05-21 12:52:22Z

1

HtmlUtility.HtmlEncode(string s)

answered May 21, 2014 at 12:52

Rik

29.3k14 gold badges52 silver badges69 bronze badges

1 Comment

Rik Over a year ago

It's a method called HtmlEncode in the HtmlUtility class which takes a string parameter and encodes it into a Html-safe string. That's a 23-word description which doesn't add any information to my answer, which is why I didn't include it in the first place

Collectives™ on Stack Overflow

How to convert string to HTML safe string

5 Answers 5

Comments

1 Comment

Comments

Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

Comments

1 Comment

Comments

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related