ASP.NET Textbox省略双引号后的字符串

Question

I have added an ASP.NET Textbox in my page and i do have next and previous button. I entered string, say Hello "World" in the textbox. I clicked on next button which will show the review page(non-editable), all the datas are stored in the sessioin. After this i am clicking on the previous button which should show me the entry fields(edit page). During this, i am getting the datas from the session and showing it back to the ASP.NET textbox.

When i see the page, what ever entered after double quotes is getting removed from the ASP.NET textbox. that is, i can only see Hello .

My requirement is like, i should allow the users to enter double quotes.

Is there any way to fix this???

Answer 1

ASP.NET doesn't remove quotes in a textbox, so I would suggest posting code for review.

However, allowing quotes in input fields can trigger request validation in some cases, in which cases you would see a very specific error about a potentially dangerous request.

Speaking of which, text fields which allow quotes should be checked for XSS attacks.

Answer 2

I reproduce you encounter case now. It cause by using double quotes in the value property,

it will conflict with the value which also contain double quotes in textbox. So you should

change the double quotes to single quotes in output syntax.

You can try the below code:

output.Write(string.Format("<input name=\"{0}\" id=\"{0}\" type=\"text\" value=\'{1}\'{2}/>", UniqueID, Text, args));

Answer 3

I didn't meet this issue before,It's OK for user to enter double quotes in textbox.

you can check if you have some program logic to filter the quote or debug your code to

find the cause. The below is a simple testing code.

<form id="form1" runat="server">
<div>
<asp:TextBox ID="TextBox1" runat="server"></asp:TextBox>
    <asp:Button
    ID="Button1" runat="server" Text="Button" onclick="Button1_Click" />
    <asp:Button ID="Button2" runat="server" Text="Button" onclick="Button2_Click" />

</div>
</form>

protected void Button1_Click(object sender, EventArgs e)
{
    Session.Add("KK",this.TextBox1.Text);
}
protected void Button2_Click(object sender, EventArgs e)
{
    this.TextBox1.Text = Session["KK"] as string;
}

Answer 4

If you overwrite "Render" you could also utilize that you are outputting to HtmlTextWriter which provides some help to creating html.

While the sample below certainly is more verbose than your approach, it will also make the output aware of what is going on and allows the HtmlTextWriter (output) to insert values etc. The HtmlTextWriter will then ensure that the proper escaping is performed on the values.

  protected override void RenderContents(HtmlTextWriter output)
  {
        output.AddAttribute(HtmlTextWriterAttribute.Name, UniqueID);
        output.AddAttribute(HtmlTextWriterAttribute.Type, Text);
        output.AddAttribute(HtmlTextWriterAttribute.Value, Value);
        output.RenderBeginTag(HtmlTextWriterTag.Input);
        output.RenderEndTag();
  }

alternatively you could use System.Web.HttpUtility.HtmlEncode to avoid problems with character values etc.