CODEWITHSUNDEEP
c#asp.netasp.net-mvcrazor
Steven
Steven

Reputation: 18869

Passing a parameter with an ampersand to a controller action method

I have a view that displays a link of vendors, with a link to each vendor detail page

@foreach (var vendor in Model.Vendors)
{
    <li>
        <a href="/Vendors/@(vendor.Name)">@vendor.Name</a>
    </li>
}

One particular vendor is named "ABC Sales & Services", so the link to their detail page is /Vendors/ABC Sales & Services. When I navigate to that url, I get this error:

A potentially dangerous Request.Path value was detected from the client (&).

Is there a way to get around this?

Upvotes: 3

Views: 2157

Answers (4)

Esteban Elverdin
Esteban Elverdin

Reputation: 3582

You can use

<a href="@Url.Action("/Vendors/" + @vendor.Name)">@vendor.Name</a>

Upvotes: 0

Bassam Mehanni
Bassam Mehanni

Reputation: 14944

You should UrlEncode the vendor name:

<a href="/Vendors/@Url.Encode(vendor.Name)">@vendor.Name</a>

By the way, this is done on your behalf when you use Url.Action or the Html.Action methods to construct your anchor tags

Upvotes: 1

Calvin Allen
Calvin Allen

Reputation: 4248

You should really utilize the ID of the vendor (hopefully, there is a primary key - either numeric/guid - on your database), not the name.

Upvotes: 1

Jcl
Jcl

Reputation: 28272

Add this to web.config's httpRuntime:

<httpRuntime requestPathInvalidChars="&lt;,&gt;,*,%,:,\,?" />

By default that list includes &amp;, you are simply removing it

Upvotes: 4

Related Questions