building url with StringBuilder

[John A Grandy]

I am using a StringBuilder to build a link tag (based on categoryId and
categoryName , which are populated elsewhere ) :

StringBuilder sb = new StringBuilder();
sb.Append("<a href=\"http://www.mywebsite.com/mypage.aspx?category=");
sb.Append(categoryId);
sb.Append("&filter=price\">");
sb.Append(categoryName);
sb.Append("</a>");
html += sb.ToString();

Does the embedded "&" character need special handling? Should I replace "&"
with "&amp;" ? Or some other encoding ?

 

[Mythran]

I am using a StringBuilder to build a link tag (based on categoryId and
categoryName , which are populated elsewhere ) :

StringBuilder sb = new StringBuilder();
sb.Append("<a href=\"http://www.mywebsite.com/mypage.aspx?category=");
sb.Append(categoryId);
sb.Append("&filter=price\">");
sb.Append(categoryName);
sb.Append("</a>");
html += sb.ToString();

Does the embedded "&" character need special handling? Should I replace
"&" with "&amp;" ? Or some other encoding ?

If this code is inside a method in a Page or web control, you can use the
method "UrlEncode", so ...

============================

string urlFormat =
"http://www.mywebsite.com/mypage.aspx?category={0}&filter=price";
string tagFormat = "<a href=\"{0}\">{1}</a>";
string url = Server.UrlEncode(string.Format(urlFormat, categoryId));
html += string.Format(tagFormat, url, categoryName);

============================

Also, using a StringBuilder for something like this is a bit of overkill
IMHO.

HTH

Mythran

 

[John A Grandy]

Hi Mythran, and thanks for the response.

Your method seems to work ... but I don't think that encoding the entire url
is necessary. It seems wasteful to unnecessarily substitute so many
characters. Which characters really need to be encoded ?

Here are the results of my test:

string categoryId = "100";
string categoryName = "toys & games";
string urlFormat =
"http://www.mywebsite.com/mypage.aspx?category={0}&filter=price";
string tagFormat = "<a href=\"{0}\">{1}</a>";
string url = Server.UrlEncode(string.Format(urlFormat, categoryId));
string html = string.Format(tagFormat, url, categoryName);

html = <a
href="http%3a%2f%2fwww.mywebsite.com%2fmypage.aspx%3fcategory%3d100%26filter%3dprice">toys
& games</a>

 

[Mythran]

Hi Mythran, and thanks for the response.

Your method seems to work ... but I don't think that encoding the entire
url is necessary. It seems wasteful to unnecessarily substitute so many
characters. Which characters really need to be encoded ?

Here are the results of my test:

string categoryId = "100";
string categoryName = "toys & games";
string urlFormat =
"http://www.mywebsite.com/mypage.aspx?category={0}&filter=price";
string tagFormat = "<a href=\"{0}\">{1}</a>";
string url = Server.UrlEncode(string.Format(urlFormat, categoryId));
string html = string.Format(tagFormat, url, categoryName);

html = <a
href="http%3a%2f%2fwww.mywebsite.com%2fmypage.aspx%3fcategory%3d100%26filter%3dprice">toys
& games</a>

Oops

string url = string.Format(urlFormat, Server.UrlEncode(categoryId));

Basically, the goal is to encode any data in the querystring. So, you would
encode ... you should also encode categoryName as html using
Server.HtmlEncode, so that if this comes from a database, users can't enter
script (IE: <script language...) in categoryName...

HTH

Mythran