c# replace string function not returning expected results

Question

string message = CommonFunctions.SanitiseInput(context.Request.QueryString["msg"]);

And the function is defined as:

// Sanitise input
public static string SanitiseInput(string inputText)
{
    string cleanedString = inputText;

    cleanedString.Replace("<","&lt;");      // No code
    cleanedString.Replace(">", "&gt;");
    cleanedString.Replace("&", "&amp;");    // No query string breaks

    return cleanedString;
}

Given input "rg" this returns the same, and not "rg"

possible duplicate of String.Replace does not seem to replace brackets with empty string... — Fredrik Mörk
– Fredrik Mörk, Commented Feb 22, 2011 at 10:18
just a note: it seems to me that you're basically duplicating the builtin HttpServerUtility.UrlEncode function (maybe it's just because you've simplified your scenario to explain your question) — Paolo Falabella
– Paolo Falabella, Commented Feb 22, 2011 at 10:22
Note that you have to replace & before replacing < and >, otherwise < will end up as < and > will end up as >. — Guffa
– Guffa, Commented Feb 22, 2011 at 10:22

Zooba · Accepted Answer · 2011-02-22 10:17:34Z

7

The Replace function in C# does not modify the string itself - it returns a modified version of the string.

Try this:

public static string SanitiseInput(string inputText)
{
    string cleanedString = inputText;

    cleanedString = cleanedString.Replace("<","&lt;");      // No code
    cleanedString = cleanedString.Replace(">", "&gt;");
    cleanedString = cleanedString.Replace("&", "&amp;");    // No query string breaks

    return cleanedString;
}

For "rg" this will give you "&lt;b&gt;rg&lt;/b&gt;". To fix up the unnecessary conversions to "&", move the third replacement to before the other two, which will give you the result you are expecting.

answered Feb 22, 2011 at 10:17

Zooba

11.5k3 gold badges39 silver badges40 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Rup Over a year ago

In any case you probably want to use System.Web.HttpUtility.HtmlEncode, or if you're running with the .NET Client profile you can get equivalent code from Microsoft's AntiXSS library, or you could copy the HtmlEncode code into your project from Reflector

Zooba Over a year ago

@Rup Agreed, and I upvoted the answer that suggested that, as well as answering the problem with the given code and voting to close as an exact duplicate... I feel like I've done too much work here.

Felice Pollano · Accepted Answer · 2011-02-22 10:19:04Z

3

You should use HttpUtility.HtmlEncode(): http://msdn.microsoft.com/en-us/library/system.web.httputility.htmlencode.aspx

answered Feb 22, 2011 at 10:19

Felice Pollano

33.4k10 gold badges77 silver badges125 bronze badges

Comments

Bolu · Accepted Answer · 2011-02-22 10:18:01Z

1

I think you need to use cleanedString = cleanedString.Replace("<","<"); etc.

answered Feb 22, 2011 at 10:18

Bolu

8,8065 gold badges40 silver badges75 bronze badges

Collectives™ on Stack Overflow

c# replace string function not returning expected results

3 Answers 3

2 Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related