Html attributes, single quote and HtmlAttributeEncode

September 11, 2007

When you develop your own custom controls do not forget that HtmlAttributeEncode method DOES NOT encode single quote.

MSDN says:

The string result from the HtmlAttributeEncode method should be used only for double-quoted attributes. Security issues might arise when using the HtmlAttributeEncode method with single-quoted attributes.

So you should use double quotes

Entry Filed under: .net, asp.net, tip. .

Leave a Comment

Required

Required, hidden

Some HTML allowed:
<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <pre> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Trackback this post  |  Subscribe to the comments via RSS Feed


Calendar

September 2007
M T W T F S S
« Aug   Oct »
 12
3456789
10111213141516
17181920212223
24252627282930

Most Recent Posts