Encoding parameters for a URL

问题:

I have a Silverlight application that is building a URL. This URL is a call to a REST-based service. This service expects a single parameter that represents a location. The location is in the form of "city, state". To build this URL, I'm calling the following code:

string url = "http://www.domain.com/myService.svc/";
url += HttpUtility.UrlEncode(locationTextBox.Text);

If a user enters "chicago, il" into locationTextBox, the result looks like this:

http://www.domain.com/myService.svc/chicago%2c+il

In reality though, I was kind of expecting the URL to look like;

http://www.domain.com/myService.svc/chicago,%20il

When testing my service via the browser URL, the one I am expecting works. However, the url that is being generated is not working. What am I doing wrong?

回答1:

I would recommend Uri.EscapeDataString instead of using HttpUtility functions. See discussion in Server.UrlEncode vs. HttpUtility.UrlEncode.

回答2:

Try to use the UrlPathEncode() method. View the remarks at: http://msdn.microsoft.com/en-us/library/h10z5byc.aspx

Quote:

You can encode a URL using with the UrlEncode() method or the UrlPathEncode() method. However, the methods return different results. The UrlEncode() method converts each space character to a plus character (+). The UrlPathEncode() method converts each space character into the string "%20", which represents a space in hexadecimal notation. Use the UrlPathEncode() method when you encode the path portion of a URL in order to guarantee a consistent decoded URL, regardless of which platform or browser performs the decoding.

回答3:

The safest bet is to use the AntiXss library. It has more standard (and secure) versions for encoding contents to various purposes (like Url encodes, Html and HtmlAttribute encodes, and more). there's the old 3.1 version available for download from MS site (http://www.microsoft.com/downloads/details.aspx?FamilyId=051ee83c-5ccf-48ed-8463-02f56a6bfc09), which will work with older .NET versions, and the new one at http://wpl.codeplex.com/