How to unencode attribute when calling Html.BeginForm

Question

I'm trying to hook into Google Analytics and have this:

@using (Html.BeginForm("Register", "Account", FormMethod.Post, 
        new { id = "account-register-form", 
        onsubmit = "_gaq.push(['_link', 'someurl'])" }))

My rendered view then looks like this:

<form action="/Account/Register/Basic" id="account-register-form" method="post" 
onsubmit="_gaq.push([&#39;_link&#39;, &#39;someurl&#39;])">

I have tried Html.Raw("_gaq.push(['_link', 'someurl'])") but this does not work, because I think BeginForm does the encoding.

c0demaster · Accepted Answer · 2011-08-27 13:04:23Z

2

Code works fine if don't turn off encoding but you can turn off attribute encoding by creating a class like this:

public class HtmlAttributeEncodingNot : System.Web.Util.HttpEncoder
{
protected override void HtmlAttributeEncode(string value, System.IO.TextWriter output)
{
    output.Write(value);
}
}

and adding this to web.config under :

<httpRuntime encoderType="HtmlAttributeEncodingNot"/>

answered Aug 27, 2011 at 13:04

c0demaster

7407 silver badges19 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

adriaanp Over a year ago

Thanks did not know about this setting. But would this be safe? I don't want to risk something by doing this.

c0demaster Over a year ago

@adriannp Safety depends on your code, there is no vulnerability for your codes on question because codes came from your source codes, but if html attributes comes from database and the supplier is web user so there is a vulnerability because you are not encoding the user supplied data. so user(hacker) can write a jscript xss or any bad codes into your html attributes. sorry for the english =) i hope you understand

Darin Dimitrov · Accepted Answer · 2011-08-27 12:39:18Z

1

You don't need to unencode anything. What you have is perfectly valid markup and working javascript, as seen in the following live demo:

<form action="#" method="get" onsubmit="alert(&#39;some test&#39;);">
    <input type="submit" value="OK" />
</form>

So keep your code as is.

answered Aug 27, 2011 at 12:39

Darin Dimitrov

1.0m276 gold badges3.3k silver badges3k bronze badges

3 Comments

adriaanp Over a year ago

I never tested it to see if it would work. Did not know this would be valid. But because this looks nasty I'm feeling dirty of having it as is ;)

Darin Dimitrov Over a year ago

@adriaanp, would you expect MVC helpers to generate invalid markup?

adriaanp Over a year ago

I guess not, I'm going to leave it as is.

Bikal Lem · Accepted Answer · 2011-08-27 11:14:06Z

1

If you don't have to use the Html.BeginForm then use can use the code snippet below to solve your formatting issue.

<form action="@Url.Action("Register", "Account")" 
    method="POST" id="account-register-form" 
    onsubmit="_gaq.push(['_link', 'someurl'])">
</form>

This outputs the html you require.

answered Aug 27, 2011 at 11:14

Bikal Lem

2,42318 silver badges19 bronze badges

1 Comment

adriaanp Over a year ago

This is what I went with in the end, but @Darin have a point, maybe I should just left it as is.

Collectives™ on Stack Overflow

How to unencode attribute when calling Html.BeginForm

3 Answers 3

2 Comments

3 Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

3 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related