CODEWITHSUNDEEP
asp.nethtml-encode
0xFF
0xFF

Reputation: 4178

Disable HTML Encoding on Asp.net HyperLink attributes

I have a HyperLink on my usercontrol in which I set the onlick event dynamically on the server side like this :

this.Attributes["onclick"] = string.Format("javascript:alert('{0}')", base.NavigateUrl);

The problem is that when Asp.net renders the page, it ends up with something like this

<a href='...' onclick="javascript:alert(&#39;TEST&#39;)>LINK</a>

which obviously is not valid Javascript. Using " instead of ' wouldn't help neither, the generated HTML is alert(&quot;TEST&quot;)

Is there any way around this?

Thank you.

Upvotes: 0

Views: 2390

Answers (3)

Dmitry Kirsanov
Dmitry Kirsanov

Reputation: 94

royu,

Unfortunately, Microsoft thinks this is a "security feature" and they don't really care about browser or JavaScript compatibility. One way to override it is to use Eval([string]) instead of the plain text. In that case the value should not be encoded.

Upvotes: 0

royu
royu

Reputation: 377

It is not working when using Jquery.

Server side:

this.Attributes["onclick"] = "$('#button').click();";

Client side:

onclick="$(&amp;#39;#button&amp;#39;).click();" gives an error.

Is there anyway to just get 'real' single quotes client side?

Upvotes: 1

Jacob
Jacob

Reputation: 78850

onclick="javascript:alert(&#39;TEST&#39;)" is perfectly valid. When the page is parsed, entities should be replaced with their counterparts before JavaScript processes the value. So in pass 1, the HTML parser will change the attribute value to javascript:alert('TEST');, which is valid JavaScript.

Upvotes: 3

Related Questions