Encoding parameters for a URL

Question

I have a Silverlight application that is building a URL. This URL is a call to a REST-based service. This service expects a single parameter that represents a location. The location is in the form of "city, state". To build this URL, I'm calling the following code:

string url = "http://www.domain.com/myService.svc/";
url += HttpUtility.UrlEncode(locationTextBox.Text);

If a user enters "chicago, il" into locationTextBox, the result looks like this:

http://www.domain.com/myService.svc/chicago%2c+il

In reality though, I was kind of expecting the URL to look like;

http://www.domain.com/myService.svc/chicago,%20il

When testing my service via the browser URL, the one I am expecting works. However, the url that is being generated is not working. What am I doing wrong?

Answer 1

The safest bet is to use the AntiXss library. It has more standard (and secure) versions for encoding contents to various purposes (like Url encodes, Html and HtmlAttribute encodes, and more). there's the old 3.1 version available for download from MS site (http://www.microsoft.com/downloads/details.aspx?FamilyId=051ee83c-5ccf-48ed-8463-02f56a6bfc09), which will work with older .NET versions, and the new one at http://wpl.codeplex.com/

Answer 2

I would recommend Uri.EscapeDataString instead of using HttpUtility functions. See discussion in Server.UrlEncode vs. HttpUtility.UrlEncode.

Answer 3

Try to use the UrlPathEncode() method. View the remarks at: http://msdn.microsoft.com/en-us/library/h10z5byc.aspx

Quote:

You can encode a URL using with the UrlEncode() method or the UrlPathEncode() method. However, the methods return different results. The UrlEncode() method converts each space character to a plus character (+). The UrlPathEncode() method converts each space character into the string "%20", which represents a space in hexadecimal notation. Use the UrlPathEncode() method when you encode the path portion of a URL in order to guarantee a consistent decoded URL, regardless of which platform or browser performs the decoding.