How do I prevent HTML encoding of attributes in the code behind?

Question

I have the following in my aspx.

<html>
    <body>
        <input id="but" type="button" value="ClickMe" />
    </body>
</html>

Code behind

//Pageload
but.Attributes.Add("onclick", "this.parentNode.innerHTML += '<a id=""link"" href=""mylink""></a>';document.getElementById(""link"").click();");

Rendered html

<input name="ctl00$Content$btn" type="button" id="ctl00_Content_btn" value="ClickMe" 
onclick="this.parentNode.innerHTML += '&lt;a id=&quot;link&quot; href=&quot;mylink&quot;>&lt;/a>';document.getElementById(&quot;link&quot;).click();" />

How can I get the < > " characters to render properly?

Richard Lucas · Accepted Answer · 2017-10-16 14:46:11Z

4

You cannot render these characters without encoding.

From MSDN

You cannot add client-side script to a WebControl instance using the Attributes collection. To add client-side script, use the ClientScript property on the Page control.

If you insist, just render your own control.

edited Oct 16, 2017 at 14:46

Richard Lucas

6401 gold badge4 silver badges15 bronze badges

answered Jul 27, 2011 at 22:53

Aristos

66.7k16 gold badges117 silver badges154 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

DJA Over a year ago

Its funny that they say that. In the example a couple of lines further down they do exactly what they said not to do.

Aristos Over a year ago

@DJA They did not say not to do. They say that if you do this characters will be encoded on the html tag line.

Biff MaGriff · Accepted Answer · 2011-07-28 16:46:23Z

3

Thanks Aristos, this works.

Page.ClientScript.RegisterStartupScript(Me.GetType(), "butClick", "function butClick() {this.parentNode.innerHTML += '<a id=""link"" href=""mylink""></a>';document.getElementById(""link"").click();}")
but.Attributes.Add("onclick", "butClick();");

answered Jul 28, 2011 at 16:46

Biff MaGriff

8,2619 gold badges65 silver badges100 bronze badges

Comments

Martyn · Accepted Answer · 2013-03-26 16:32:38Z

If you really want to prevent the encoding of parameters, you'll need to create your own customized control and override the AddAttributesToRender method. Obviously this isn't very flexible because you'll need to create a separate custom control for each type of control you use.

Fortunately, this is very easy and only needs a few lines of code so may work out. Here is the complete code needed for a customized button:

public class MyCustomButton : Button
{
    protected override void AddAttributesToRender(HtmlTextWriter writer)
    {
        base.AddAttributesToRender(writer);
        writer.AddAttribute("onclick", "myJavascriptFunction('a string');", false); // passing false to the AddAttribute method tells it not to encode this attribute.
    }
}

Obviously, this only appends a hard-coded onclick to the end of the attributes and may interfere if an onclick has already been provided. If you wanted to take this further, you could iterate over the actual Attributes collection and add them all this way.

Justin · Accepted Answer · 2011-07-28 14:03:20Z

0

Override your Render method for the control and add this line:

base.Attributes.Add("onclick", Page.ClientScript.GetPostBackEventReference(new PostBackOptions(this, string.Empty)));

And on the page it should render as:

onclick="__doPostBack('ctl00$ctl00$PageContent$LocalContents$button_id', '')"

Which IE should understand as a postback reference, so it shouldn't encode it. .Net should match it up with your server side event handler

edited Jul 28, 2011 at 14:03

user447356

answered Jul 28, 2011 at 14:01

Justin

1

Comments

deostroll · Accepted Answer · 2011-09-26 07:36:40Z

-1

.net 4.0 has inbuilt functionality. http://msdn.microsoft.com/en-us/library/system.web.httputility.javascriptstringencode.aspx - from the docs.

answered Sep 26, 2011 at 7:36

deostroll

12k22 gold badges94 silver badges168 bronze badges

2 Comments

Biff MaGriff Over a year ago

I'm stuck in .net 2.0 for this project.

deostroll Over a year ago

use reflector or ilspy. Reflect the system.web assembly. Steal the code from there. Implement it in 2.0. Should you have difficulties let us know. :)

Collectives™ on Stack Overflow

How do I prevent HTML encoding of attributes in the code behind?

5 Answers 5

2 Comments

Comments

Comments

Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

2 Comments

Comments

Comments

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related