ASP C#: Special characters: #, $, + cant pass trough URL parameter - c#

I need to get file from virtual folders. I have GetDocumentPreview.aspx which can do it. The parameters are URL type. Below good one:
/GetDocumentPreview.aspx?name=filename&type=jpg
//But if I ask for file with #, &, + in name:
/GetDocumentPreview.aspx?name=&filename&type=jpg
/GetDocumentPreview.aspx?name=#filename&type=jpg
/GetDocumentPreview.aspx?name=+filename&type=jpg
I have no file, because of characters #, &, + (I've tested all characters).
How can I pass #, &, + to URL parameter. I need to use URL parameter because i call this class from Javascript hover tooltip with images.

You need to escape those special chars :
This function does it best :
Be careful , don't use UrlEncode

You should encode special characters if you're placing them into a URL.
You can use HttpServerUtility.UrlEncode on your string URL before placing it into the hyperlinks/buttons redirect location. An example would be:
string destinationURL = "http://www.contoso.com/default.aspx?user=specialCharacters";
NextPage.NavigateUrl = "~/Finish?url=" + Server.UrlEncode(destinationURL);
In your case, you should UrlEncode the filenames before placing them into the URL string, the special characters mentioned will be used as:
& = %26
+ = %2B
For more you can see here: http://msdn.microsoft.com/en-us/library/zttxte6w(v=vs.110).aspx

Use urlencoded value of these characters. A list can be found here -
http://www.w3schools.com/tags/ref_urlencode.asp
for example, & would be - %26.
So, /GetDocumentPreview.aspx?name=&filename&type=jpg would be - /GetDocumentPreview.aspx?name=%26filename&type=jpg

Related

Want to show # in url using c# action link and routing [duplicate]

Is it safe to use an # symbol as part of a user? For example, a possible URL would be http://example.com/#dave.
The idea is that, nowadays, users are commonly called "#user", so why not make the user page "#username"?
Percent-encoded …
You can use the # character in HTTP URI paths if you percent-encode it as %40.
Many browsers would display it still as #, but e.g. when you copy-and-paste the URI into a text document, it will be %40.
… but also directly
Instead of percent-encoding it, you may use # directly in the HTTP URI path.
See the syntax for the path of an URI. Various unrelated clauses aside, the path may consist of characters in the segment, segment-nz, or segment-nz-nc set. segment and segment-nz consist of characters from the pchar set, which is defined as:
pchar = unreserved / pct-encoded / sub-delims / ":" / "#"
As you can see, the # is listed explicitly.
The segment-nz-nc set also lists the # character explicitly:
segment-nz-nc = 1*( unreserved / pct-encoded / sub-delims / "#" )
So, a HTTP URI like this is totally valid:
http://example.com/#dave
Example
Here is an example Wikipedia page:
link
copy-and-paste: http://en.wikipedia.org/wiki/%22#%22_%28album%29
As you can see, the ", (, and ) characters are percent-encoded, but the # and the _ is used directly.
Can you use the #-symbol in a URL? - Yes, you can!
Note that that #-character, hexadecimal value 40, decimal value 64, is a reserved characters for URI's. It's usage is for things like email-addresses in mailto:URI's, for example mailto:username#somewhere.foo and for passing username and password information on a URI (which is a bad idea, but possible): http://username:password#somewhere.foo
If you want a URL that has an #-symbol in a path you need to encode it, with so called "URL-encoding". For example like this: http://somewhere.foo/profile/username%40somewhere.foo
All modern browsers will display this as http://somewhere.foo/profile/username#somewhere.foo, and will convert any typed in #-sign to %40, so it's easy to use.
Many web-frameworks will also help you either automatically, or with helper-functions, to convert to and from URL-encoded URL's.
So, in summary: Yes, you can use the #-symbol in a URL, but you have to make sure it's encoded, as you can't use the #-character.
In the RFC the following characters:
* ' ( ) ; : # & = + $ , / ? % # [ ]
are reserved and:
The purpose of reserved characters is to provide a set of delimiting
characters that are distinguishable from other data within a URI.
So it is not recommended to use these characters without encoding.
Basicaly no.
# is a reserved character and should only be used for its intended purpose.
See: http://perishablepress.com/stop-using-unsafe-characters-in-urls/ and http://www.ietf.org/rfc/rfc3986.txt
It can be used encoded, but I don't think that is what you were asking.
Apparently modern browsers will handle this. However you asked if this was safe and according to the spec of the RFC you should not be using it (unencoded) unless it is for its intended purpose.
I found this question when I tried to search site:typescriptlang.org #ts-ignore at Chrome, and then got the result of This page isn't working, ts-ignore is currently unable to handle this request and I saw the URL became "http://site:typescriptlang.org%20#ts-ignore/". I felt so refused, then searched # symbol's function at an URL and then I found my answer on Wikipedia.
The full format of the URL is scheme://userInfo#host:port/path?query#fragment. so when we search site:typescriptlang.org #ts-ignore, the browser will think you want to visit "http://site:typescriptlang.org%20#ts-ignore/". In this URL, http is a scheme, site:typescriptlang.org%20 is a userInfo ("%20" is escaped by a space character), "ts-ignore/" is a host. Of course, we can't visit the host named "ts-ignore" without a domain.
So, # symbol can be a separator between userInfo and host.

passing "&" string to controller using get method

I am trying to pass string via url GET parameters to my MVC controller. But the problem is whenever inside my string any "&" comes up its just getting skipped the text from there. The reason i found is on http get "&" is reserved for define new parameters. Is there any way to pass string smoothly?
http://localhost:60617/CategoryResearch/Result?page=1&keywords=Baby
Safety & Health
Example string is: "Baby Safety & Health"
You have to send the & encoded as this:
http://localhost:60617/CategoryResearch/Result?page=1&keywords=Baby Safety %26 Health
Here you have a complete reference on how to encode special characters:
https://www.w3schools.com/tags/ref_urlencode.asp
As mentioned in the comments, you need to UrlEncode your string before sending it. Take a look at HttpUtility.UrlEncode.
string keyWords = HttpUtility.UrlEncode("Baby Safety & Health");
Ampersand's are one of many characters that have a special meaning when your browser parses a URL. You can learn more about this from the wiki page.
In order to use these characters in a URL, the URL must be encoded. In C#, you can use UrlEncode to generate an encoded URL string.
Yes; that's correct.
You need to use JSON.stringify while placing the parameters. It will encode "&" and other special characters. For example,
data: {
emp_id: JSON.stringify(emp_id)
},

C# string format error

I need to send the value I receive from the model with this link, the proposalName field must be in quotes.How can I do it?
Here is my service url.
string path = string.Format("{ProposalId:{proposalId},ProposalName:{"proposalName"},VendorId:{vendorId}}",
Uri.EscapeDataString(proposalId.ToString()),
Uri.EscapeDataString(proposalName),
Uri.EscapeDataString(vendorId.ToString()));
You can simply put quotes around by escaping the quotes, like this -
string path = string.Format("{{0},ProposalName:\"{1}\",VendorId:{2}}",
Uri.EscapeDataString(proposalId.ToString()),
Uri.EscapeDataString(proposalName),
Uri.EscapeDataString(vendorId.ToString()));
As per your updated question, if you need to pass double quotes in URL, you need to encode it to %22
You can also use URI which allows a lot of flexibility with urls. For example -
Uri myUri = new Uri("http://google.com/search?hl=en&q=\"query with quotes\"");
Going with your example - Replace EscapeDataString with Uri.EscapeUriString. It will escape the chracter to form a valid URL. " will get replaced by %22
Some suggestions here and here-
Your problem exactlly in the {"1"} part. The double quotation mark " should be outside the {}, not inside them.
here is the fixed code.
string path = string.Format("{{0},ProposalName:\"{1}\",VendorId:{2}}",
Uri.EscapeDataString(proposalId.ToString()),
Uri.EscapeDataString(proposalName),
Uri.EscapeDataString(vendorId.ToString()));
or
string path = string.Format(#"{{0},ProposalName:""{1}"",VendorId:{2}}",
Uri.EscapeDataString(proposalId.ToString()),
Uri.EscapeDataString(proposalName),
Uri.EscapeDataString(vendorId.ToString()));
and if you are using C# 6 then you can write it as following
string path = $"{Uri.EscapeDataString(proposalId.ToString())},ProposalName:\"{Uri.EscapeDataString(proposalName)}\",VendorId:{Uri.EscapeDataString(vendorId.ToString())}";
This might do the trick for you
\"{1}\"
instead of
{"1"}
because you can put \ symbol to indicate escape sequence followed by a reserved characters
So
string.Format("{{{0},ProposalName:\"{1}\",VendorId:{2}}}",
I think escaping the quotes and placing them outside the brackets will work:
"{{0},ProposalName:\"{1}\",VendorId:{2}}"
Depending on the C# version, you can also do it like this, which I often think is an easier and cleaner way to do it:
string path = $"{proposalId},ProposalName:\"{proposalName}\",VendorId:{vendorId}";
You have two problems:
Wrong quotation (should be outside the braces {...} and escaped)
Incorrect { and } escape: {{ means just a single '{' in a formatting string
Should be
string path = string.Format("{{{0},ProposalName:\"{1}\",VendorId:{2}}}",
please, notice
escaped quotations \" which are outside {1}
tripled curly braces{{{ and }}}
Edit: in your edited question you have the same errors:
string format =
"http://mobile.teklifdosyam.com/VendorReport/GetListProposalService?&page=1&start=0&limit=10&filter=" +
"{{ProposalId:{0},ProposalName:\"{1}\",VendorId:{2}}}";
string path = string.Format(format,
Uri.EscapeDataString(proposalId.ToString()),
Uri.EscapeDataString(proposalName),
Uri.EscapeDataString(vendorId.ToString()));
please, notice escaped quotations \" which are outside the {1}, double '{{' and tripled '}}}'. When formatting you have to use numbers as place holders: so {"proposalName"} must be changed into {0}

Encode URL querystring from database

I am trying to encode searches that are sent as querystrings (Response.Redirect("/Find/" + TextBoxSearch.Text);). There is a row in the database with names including / and +, and when that enters the URL things stop working properly. I have tried encoding like this:
String encode = HttpUtility.UrlEncode(TextBoxSearch.Text);
Response.Redirect("/Find/" + encode);
But can' get it to work, what am I missing? Pretend the search value is ex/ex 18+. How could I get this to work as a querystring?
Don't know if this is important but here is how I get the querysting in my Find-page:
IList<string> segments = Request.GetFriendlyUrlSegments();
string val = "";
for (int i = 0; i < segments.Count; i++)
{
val = segments[i];
}
search = val;
I can't even encode spaces properly.
I try:
String encoded = Uri.EscapeDataString(TextBoxSearch.Text);
Response.Redirect("/Find/" + encoded);
But this does not turn spaces in the querystring in to %20. It does transform "/" though.
EDIT: At this point I would be happy to just turn this url localhost/Find/here are spaces in to localhost/Find/here+are+spaces
EDIT: I have been searching and trying solutions for over 5 hours now.
Can anyone just tell me this:
If I redirect like this Response.Redirect("/Find/" + search);
And I make a search like this Social media
I then Get the queryString as the code above using segments.
Now I want to display info about Social media from my database
but at the same time I want the url to say Find/Social+media
PS: Do I need to encode every url-string? or just where I use signs and spaces.
Instead of HttpUtility.UrlEncode use HttpUtility.UrlPathEncode. From the documentation of UrlEncode:
You can encode a URL using with the UrlEncode method or the
UrlPathEncode method. However, the methods return different results.
The UrlEncode method converts each space character to a plus character
(+). The UrlPathEncode method converts each space character into the
string "%20", which represents a space in hexadecimal notation. Use
the UrlPathEncode method when you encode the path portion of a URL in
order to guarantee a consistent decoded URL, regardless of which
platform or browser performs the decoding.
The + character does represent a space in query strings but not in the address part.

Adding an unescaped query parameter in C#

I am trying to add an unescaped parameter to a URL with the help of UriBuilder. How can I prevent the characters of the parameter to be escaped?
query.Set("oauth_signature", CONSUMER_SECRET + "%26");
builder.Query = query.ToString();
The resulting URL always contains % as an escaped sequence as the oauth_signature value (which is %25 apparently).
%26 is & right? Why not just do
query.Set("oaut_signature", CONSUMER_SECRET + "&");
A dirty workaround would be to use a token to identify where the parameter should go in, and string.Replace it afterwards. It's not safe though, which is probably why there's no easy way with UriBuilder.

Categories

Resources