正确转义URI以便在HttpClient.PostAsync中使用需要什么？

Question

Most overloads of HttpClient.PostAsync() allow either a string or URI to be passed in. Some however (in the Formatting namespace) only allow a string. To use this, I build and use a URI string like:

string uri = "http://myserver.com/" + userSuppliedName + "/dosomething/";
client.PostAsync(uri, someObject, formatter);

My concern now is that userSuppliedName can be something invalid or malicious, so I want to make sure it is escaped properly. In the documentation for System.Uri , it states that by default a passed in string will be escaped properly, but since the PostAsync method I'm using only supports a string URI, I want to check: will it escape properly automatically? If not, should I just be escaping userSuppliedName when constructing string uri instead?

Answer 1

You can pass new Uri(uri).AbsoluteUri as the first parameter and alleviate encoding issues. It'll do it for you.

Answer 2

Use Uri.EscapeDataString()

string uri = "http://myserver.com/" + Uri.EscapeDataString(userSuppliedName) + "/dosomething/";
client.PostAsync(uri, someObject, formatter);