Have Geek Brain

How to stop auto HTML encoding when assigning VB.NET HTML input field

I need to submit an HTML form to a third party site and one of the hidden fields is an XML string. XML needs to be escaped before being sent to a third party.

However, when I add plain XML to the form field, it semi-skips it for me. So when I use HTMLEncode, the XML part is double escaped. How to prevent auto-escaping that comes from .NET.

Or better yet, how else can you send escaped XML through a hidden field.

XML

<systemCode>APP</systemCode>

Main purpose for hidden input field

&lt;systemCode>APP&lt;/systemCode>

When I HTML encode it also

&amp;lt;systemCode&amp;gt;APP&amp;lt;/systemCode&amp;gt;

I can see what's going on, but I don't know how to prevent it?

0


a source to share


3 answers


In the end, I used a literal and then HTMLEncoding the XML string before assigning the HTML form variable to the textbox. A little lower:

portalReq.Text = "<input type=""hidden"" name=""portalReq"" value='" & HTMLENCODE(RequestXML) & "' />"


Not fancy, but it gets around the problem.

0


a source


Don't use HTMLEncode as well ! Use it yourself !

Sort of:



'Setting value:
hdnField.Value = Server.HtmlEncode("<systemCode>APP</systemCode>")
'Outputs: &amp;lt;systemCode&amp;gt;APP&amp;lt;/systemCode&amp;gt;

'Retrieving encoded value:
Dim escaped as string = Request.Form("hdnField")
'Retrieves: &lt;systemCode&gt;APP&lt;/systemCode&gt;

'Retrieving decoded value:
Dim myValue As String = Server.HtmlDecode(Request.Form("hdnField"))
'Retrieves: "<systemCode>APP</systemCode>"
+4


a source


You don't need to worry about HTML output. Just worry about what data is presented in the form. It doesn't matter if the HTML was fully escaped or partially escaped - the same data is sent anyway .

Both of these fields:

<input name="xml" value="&lt;systemCode>APP&lt;/systemCode>" />
<input name="xml" value="&lt;systemCode&gt;APP&lt;/systemCode&gt;" />

Get submitted as:

xml=%3CsystemCode%3EAPP%3C%2FsystemCode%3E

It's language agnostic - it's browser behavior. When the browser parses the HTML, it actually normalizes both fields to have the same html. If you look at the source of the page, you can see that the original HTML is different between inputs, but if you read the value form.innerHTML

, you can see that the parsed HTML is identical.

Demo:
http://jsfiddle.net/gilly3/Xdj5E/

0


a source






More articles:


All Articles