NET中的HtmlInputText控件中如何编码特殊字符？

Question

I have an input control

<input id="firstNameField" type="text" runat="server" />

And I give it a value server-side

firstNameField.Value = "Me!"

How do I encode the "!" character for output? I tried this:

firstNameField.Value = "Me!"

But .Net responds with this:

<input name="firstNameField" type="text" id="firstNameField" value="Me&amp;#33;" />

Causing the user to see Me! in the text box. I understand that this is part of .Net's built-in XSS protection. How do I get .Net to encode for special characters other than ampersand?

Answer 1

在分配后面代码中的值时，使用HttpUtility.HtmlEncode（“ text”）

Answer 2

I wound up extending the HttpEncoder class like so:

using System;
using System.Collections;
using System.Collections.Generic;
using System.Data;
using System.Diagnostics;
using System.Web;
using System.Web.Util;
using System.Text;
using System.IO;

/// <summary>
/// Summary description for CustomHttpEncoder
/// </summary>
public class CustomHttpEncoder : HttpEncoder
{
    //
    // TODO: Add constructor logic here
    //
    public CustomHttpEncoder()
    {
    }

    protected override void HtmlEncode(string value, TextWriter output)
    {
        if (value != null) {
            MyHtmlEncode(value, output);
        }
    }

    protected override void HtmlAttributeEncode(string value, TextWriter output)
    {
        if (value != null) {
            MyHtmlEncode(value, output);
        }
    }

    private void MyHtmlEncode(string value, TextWriter output)
    {
        if (value != null) {
            string encodedValue = "";

            for (int i = 0; i <= value.Length - 1; i++) {
                byte[] asciiVal = Encoding.ASCII.GetBytes(value.Substring(i, 1));
                encodedValue += "&#" + asciiVal(0).ToString + ";";
            }

            output.Write(encodedValue);
        }
    }

}

And then referencing it in Web.config:

<system.web>
    <httpRuntime encoderType="CustomHttpEncoder" />

After that, all I had to do was set the value like normal:

firstNameField.Value = "Me!"

Which automatically encodes every character for maximum tin-foil hat security:

<input name="firstNameField" type="text" id="firstNameField" value="&#77;&#101;&#33;" />

This suits my purposes well enough, but I could see it being a PITA in other situations. In that case, MyHtmlEncode() would need to be modified to suit such situations.