C# Escaping & sign

Question

I am writing ac# application the uses the Fishbowl Inventory API.

It works well but I am having problems when the customer name has special characters like "&".

For example: "spirits & wines, LLC" I need help escaping the "&" sign so my program doesn't crash.

Here is my xml string.

string customerFBCommand = "" +
            "<FbiXml>" +
                "<Ticket><Key>" + key + "</Key></Ticket>" +
                "<FbiMsgsRq> " +
                    "<CustomerSaveRq>" +
                        "<Customer>" +
                            "<Status>Normal</Status>" +
                            "<CustomerID>-1</CustomerID>" +
                            "<AccountID>-1</AccountID>" +
                            "<Name>" +  name + "</Name>" +
                            "<ActiveFlag>true</ActiveFlag>" +
                            "<JobDepth>1</JobDepth>" +
                            "<Addresses>" +
                                "<Address>" +
                                    "<Name>Billing Address</Name>" +
                                    //"<Attn>Attn</Attn>"+
                                    "<Street>" + billing[0] + " " + billing[1] + " " + billing[2] + "</Street>" +
                                    "<City>" + billing[4] + "</City>" +
                                    "<Zip>" + billing[3] + "</Zip>" +
                                    "<Default>true</Default>" +
                                    "<Residential>false</Residential>" +
                                    "<Type>Main Office</Type>" +
                                    "<State>" +
                                        "<Name> </Name>" +
                                        "<Code>"+ billing[5] +"</Code>" +
                                        "<CountryID>2</CountryID>" +
                                    "</State>" +
                                    "<Country>" +
                                        "<Name>"+ billing[6] +"</Name>" +
                                        "<Code>US</Code>" +
                                    "</Country>" +
                                    "<AddressInformationList>" +
                                        "<AddressInformation>"+
                                            "<Name>Billing Address</Name>"+
                                            "<Data>Address Data</Data>" +
                                            "<Default>true</Default>" +
                                            "<Type>Home</Type>" +
                                        "</AddressInformation>" +
                                    "</AddressInformationList>" +
                                "</Address>" +
                                "<Address>" +
                                    "<Name>Shipping Address</Name>" +
                                    "<Attn>Attn</Attn>" +
                                    "<Street>" + shipping[0] + " " + shipping[1] + " " + shipping[2] + "</Street>" +
                                    "<City>" + shipping[4] + "</City>" +
                                    "<Zip>" + shipping[3] + "</Zip>" +
                                    "<Default>false</Default>" +
                                    "<Residential>false</Residential>" +
                                    "<Type>Ship To</Type>" +
                                    "<State>" +
                                        "<Name> </Name>" +
                                        "<Code>" + shipping[5] + "</Code>" +
                                        "<CountryID>2</CountryID>" +
                                    "</State>" +
                                    "<Country>" +
                                        "<Name>" + shipping[6] + "</Name>" +
                                        "<Code>US</Code>" +
                                    "</Country>" +
                                    "<AddressInformationList>" +
                                        "<AddressInformation>" +
                                            "<Name>Shipping Address</Name>" +
                                            "<Data>Address Data</Data>" +
                                            "<Default>true</Default>" +
                                            "<Type>Home</Type>" +
                                        "</AddressInformation>" +
                                    "</AddressInformationList>" +
                                "</Address>" +
                            "</Addresses>" +
                        "</Customer>" +
                    "</CustomerSaveRq>" +
                "</FbiMsgsRq>" +
            "</FbiXml>" +
            "";

Thanks.

Answer 1

To escape strings for XML, you can use SecurityElement.Escape . There's more than just & to escape.

However, what I would suggest is to not build the XML by hand, but to use a proper DOM like XDocument to build it for you.

Answer 2

In XML and HTML, you escape it with & . So in your C# code you can write name.Replace("&", "&") .

However a more robust solution would be to use an XML writer, which .NET has a library for. Or you could use HttpUtility.HtmlEncode(name); . There are several solutions.