Should I use both HtmlEncode and JavaScriptStringEncode if inside HTML <script> tag?

Question

I want to render in .NET a string destined for Javascript, say:

<html>
...
<script>
   alert('<%= this.MyStringHere %>');
</script>
</html>

How should I encode MyStringHere? Do I need HttpUtility.HtmlEncode(HttpUtility.JavaScriptStringEncode(unencodedString)) or is just HttpUtility.JavaScriptStringEncode(unencodedString) sufficient? Or are both wrong?

Feel free to mention alternative server tag <% solutions in your answer too, but I'm looking for the code-based solution, the example is a little contrived.

nothingisnecessary · Accepted Answer · 2019-02-01 16:40:47Z

10

You only need to encode the script for JS use, no need to double encode using HTML encoding. Just HTML encoding will not work either because it will not encode \n etc.

<script>
   alert(<%=HttpUtility.JavaScriptStringEncode(this.MyStringHere, true)%>);
   alert("<%=HttpUtility.JavaScriptStringEncode(this.MyStringHere, false)%>");
</script>

Note that JavaScriptStringEncode will not add the double quotes by default - see official docs.

If you have server-side JSON package installed, you could also use that - and it will also work for arrays, dictionaries etc.. Note that it will also add quotes for strings so you do not add them yourself.

You also have to remember that you cannot use <%: text %> syntax since that does the HTML encoding. In MVC Razor views you even have to explicitly disable HTML encoding by using @Html.Raw(Json.Encode(...)).

edited Feb 1, 2019 at 16:40

nothingisnecessary

6,26138 silver badges64 bronze badges

answered Oct 11, 2013 at 15:14

Knaģis

21.6k9 gold badges71 silver badges80 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

ij6 Over a year ago

According to the source, the default is to not include the quotes.

Collectives™ on Stack Overflow

Should I use both HtmlEncode and JavaScriptStringEncode if inside HTML <script> tag?

1 Answer 1

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related