ASP.Net URLEncode Ampersand for use in Query String

Question

I need to redirect to a url passing a parameter as a query string.

This can include an Ampersand in the value. such as

string value = "This & That";
Response.Redirect("http://www.example.com/?Value=" + Server.UrlEncode(value));

This however returns http://www.example.com/?Value=This+&+That

What should I be using to encode this string?

EDIT: Thanks Luke for pointing out the obvious, the code does indeed work correctly. I Apologise, my question was not a valid question after all!

The page I was going to had a lot of old legacy code which is apparently doing some kinda of encoding and decoding itself making it appear as if my urlencode was not working.

My solution unfortunately is to completely drop use of an & until the code in question can be re-written. Don't you just hate old code!

Cœur · Accepted Answer · 2016-12-29 17:57:29Z

24

The documentation suggests that Server.UrlEncode should handle ampersands correctly.

I've just tested your exact code and the returned string was correctly encoded:

http://www.example.com/?Value=This+%26+That

edited Dec 29, 2016 at 17:57

Cœur

39k25 gold badges207 silver badges282 bronze badges

answered Feb 18, 2009 at 17:41

LukeH

271k59 gold badges373 silver badges411 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Robin Day Over a year ago

You are totally correct! The page I was using was going to had a lot of old legacy code which is apprently doing some kinda of encoding and decoding itself making it appear as if my urlencode was not working. This works correctly.. as it should!!

Adam Lassek Over a year ago

In situations where you don't have a Server variable, you can also access the urlencode/urldecode methods through System.Web.HttpUtility

Doctor Jones Over a year ago

Note for other people visiting this page; if you're not within an ASP application (and therefore haven't got access to Server) you can use System.Web.HttpUtility.UrlEncode.

TheAtomicOption Over a year ago

Also note that Server.UrlEncode, System.Web.HttpUtility.UrlEncode, System.Uri.EscapeDataString, and System.Uri.EscapeUriString do not agree on how to encode things. Don't expect them to have the same outputs, and be careful when trying to compare or decode things especially when special characters are involved.

Doctor Jones · Accepted Answer · 2012-01-05 10:20:42Z

19

Technically doing:

value = value.Replace("&", "%26")

will do the trick.

EDIT: There seem to be some tricky issues with the whole UrlEncode/HttpEncode methods that don't quite do the trick. I wrote up a simple method a while back that may come in handy. This should cover all the major encoding issues, and its easy to write a "desanitizer" as well.

Protected Function SanitizeURLString(ByVal RawURLParameter As String) As String

      Dim Results As String

      Results = RawURLParameter    

      Results = Results.Replace("%", "%25")
      Results = Results.Replace("<", "%3C")
      Results = Results.Replace(">", "%3E")
      Results = Results.Replace("#", "%23")
      Results = Results.Replace("{", "%7B")
      Results = Results.Replace("}", "%7D")
      Results = Results.Replace("|", "%7C")
      Results = Results.Replace("\", "%5C")
      Results = Results.Replace("^", "%5E")
      Results = Results.Replace("~", "%7E")
      Results = Results.Replace("[", "%5B")
      Results = Results.Replace("]", "%5D")
      Results = Results.Replace("`", "%60")
      Results = Results.Replace(";", "%3B")
      Results = Results.Replace("/", "%2F")
      Results = Results.Replace("?", "%3F")
      Results = Results.Replace(":", "%3A")
      Results = Results.Replace("@", "%40")
      Results = Results.Replace("=", "%3D")
      Results = Results.Replace("&", "%26")
      Results = Results.Replace("$", "%24")

      Return Results

End Function

edited Jan 5, 2012 at 10:20

Doctor Jones

21.8k13 gold badges81 silver badges103 bronze badges

answered Feb 18, 2009 at 17:05

Dillie-O

29.9k14 gold badges103 silver badges142 bronze badges

7 Comments

Zhaph - Ben Duguid Over a year ago

Agreed. "&" is a reserved character in a URL, and so wouldn't be URL encoded.

BC. Over a year ago

Technically, you only need to 'Sanitize' forward slashes, ampersands, and question marks. URLEncode will do the rest.

Dillie-O Over a year ago

For some reason I thought spaces had to be re-encoded to the %20 and not +, or can it go either way?

LukeH Over a year ago

@Dillie-O, The recommended encoding for space is now "%20", but historically "+" was used (see page 7 of tools.ietf.org/html/rfc1630 for more info). Pretty much all browsers/servers etc will handle either encoding, though I've no idea why .NET still uses the obsolete "+".

big_tommy_7bb Over a year ago

Wouldn't Results = Results.Replace("%", "%25") screw up the ones above it.

|

Rekshino · Accepted Answer · 2018-11-29 08:49:38Z

3

In .net core ver 2.1 ( late 2018 ) I was able to use the following:

System.Web.HttpUtility.UrlEncode(string_to_encode)

edited Nov 29, 2018 at 8:49

Rekshino

7,3943 gold badges24 silver badges52 bronze badges

answered Nov 29, 2018 at 8:10

Eli

1,8561 gold badge22 silver badges27 bronze badges

Comments

goku_da_master · Accepted Answer · 2010-09-22 16:18:07Z

2

Another character that needs escaping is the apostrophe. Replace it with %27.

string url = Server.UrlEncode(value).Replace("'", "%27);

HttpUtility.UrlEncode() And Server.UrlEncode() do not replace this character along with a few others for backwards compatibility with other .Net Frameworks. See this microsoft article for details: http://connect.microsoft.com/VisualStudio/feedback/details/214349/httputility-urlencode-does-not-encode-apostrophe

answered Sep 22, 2010 at 16:18

goku_da_master

4,3671 gold badge45 silver badges43 bronze badges

Comments

tigerdev · Accepted Answer · 2011-03-25 13:19:51Z

2

this is correct however if you have several parameters in the query string.

for example : &firstname=bob&secondName="Tracy and John"

answered Mar 25, 2011 at 13:19

tigerdev

211 bronze badge

Comments

Uwe Keim · Accepted Answer · 2012-10-20 07:21:48Z

2

You must use Server.UrlEncode(string containing the ampersand).

I've just tested it and the returned query string was correctly encoded and then decoded.

HttpUtility didn't work for this operation.

edited Oct 20, 2012 at 7:21

Uwe Keim

40.9k61 gold badges193 silver badges308 bronze badges

answered Jun 20, 2012 at 13:55

Omgee Cares

4172 gold badges5 silver badges12 bronze badges

Comments

Dave Clemmer · Accepted Answer · 2012-10-26 05:27:57Z

1

And if you are getting a value from a GridView the & ampersand may very well be showing up as "&":

row.Cells[4].Text.ToString() = xxxx&amp;

So in this case you will want to use:

.Replace("&amp;", "%26")

edited Oct 26, 2012 at 5:27

Dave Clemmer

3,77312 gold badges53 silver badges72 bronze badges

answered Mar 16, 2012 at 14:49

Kinch

111 bronze badge

Collectives™ on Stack Overflow

ASP.Net URLEncode Ampersand for use in Query String

7 Answers 7

4 Comments

7 Comments

Comments

Comments

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

7 Answers 7

4 Comments

7 Comments

Comments

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related