How Can DeActivate Razor Html Encoding ?

Question

In Razor view I have a Javascript function. This function take 2 URLS String in arguments and call AJAX to do operation. When I generated Url string in Razor, Razor change the URLS. Like changed & to & and damage my query strings which used in my URL address. Also Html.Raw() has not work in this case.

What can I do ?

EXAMPLE:

In my Razor editor:

<a href="#" style="color:#0564c1;" onclick="PopUpStart('POST','','',200,100,'@(Html.Raw(address+"/index/?id="+baseObject.Id+"&"+"type="+dataTypeInt))','@Html.Raw(address + "/cancel/?id="+baseObject.Id+"&type="+dataTypeInt )','ReloadPage',true);return false;">
    Edit
</a>

In result :

<a href="#" style="color:#0564c1;" onclick="PopUpStart('POST','','',200,100,'/PdfInstanceEdit/index/?id=1&amp;type=270','/PdfInstanceEdit/cancel/?id=1`&amp;`type=270','ReloadPage',true);return false;">
    Edit
</a>

The URL address like :

address+"/index/?id="+baseObject.Id+"&"+"type="+dataTypeInt

Change to :

/PdfInstanceEdit/index/?id=1&type=270

In other world character & => &

It would be actually easier to construct that url by using `Url.Action()`... — Patryk Ćwiek, Jan 23 '14 at 12:13
@user3227633 post the way you used `@Html.Raw()` please. My curiosity is over the roof on this one. — Andrei V, Jan 23 '14 at 12:17
@PatrykĆwiek How Can I Call java script functions in Url.Action()? — MABDigital, Jan 23 '14 at 12:18
Yes he did. Sorry about that. I must have been looking for something else and missed it. — Andrei V, Jan 23 '14 at 12:21
@MABDigital You don't call Javascript *in* `Url.Action`. `Url.Action` only returns a string that represents an address of the controller and action with all route parameters that you'll provide, [here you have an example](http://stackoverflow.com/a/5872349/1180426) — Patryk Ćwiek, Jan 23 '14 at 12:23
@PatrykĆwiek Assume My Url Address is Not in my WebSite and point to Other Domain out of my website, How Can i Use Url.Action? and that domain Developed by ASP.Net Form Technology. — MABDigital, Jan 23 '14 at 12:35
@MABDigital You can't use it in such situation. You'd have to build the address manually, and while you're at it, you might want to [look at this question and answers](http://stackoverflow.com/q/829080/1180426) — Patryk Ćwiek, Jan 23 '14 at 12:36
@PatrykĆwiek Exactly, I Can't, so when I Want Generate address manually Razor change my '&' character (which used in My address) to '& amp;' — MABDigital, Jan 23 '14 at 12:39
@PatrykĆwiek Thanks for your Helping. I learned many things in this chat. My Problem Solved with `Action.Url` and `String.Format` — MABDigital, Jan 23 '14 at 13:03

score 0 · Answer 1 · edited May 23 '17 at 12:11

0

You should use Html.Raw() as suggested in the comments, see the documentation.

As described in this thread, if you have a particular problem with the output encoded format, you could use the HttpUtility.HtmlDecode() function, see documentation.

@Html.Raw(HttpUtility.HtmlDecode(address+"/index/?id="+baseObject.Id+"&"+"type="+dataTypeInt))

But since this could be a solution I cannot address you problem precisely...

edited May 23 '17 at 12:11

Community

1
1

answered Jan 23 '14 at 12:14

cubitouch

1,929
15
28

Thanks @cubitouch , But Return Same Result. Razor Changed & To '& amp ;'. – MABDigital Jan 23 '14 at 12:25

score 0 · Accepted Answer · edited Jan 23 '14 at 13:15

Its usually a bad idea to try and combine server code and client strings inside the quotes of a property (ie onclick="something@(something())" )

Its better to just return the entire lot in a server side function

Here's how I would rework your code:

<a href="#" style="color:#0564c1;"                               
onclick="@Html.Raw(
  String.Format(
    "PopUpStart('POST','','',200,100,'{0}','{1}','ReloadPage',true);return false;"
    , Url.Action("index",address,new{id = baseObject.Id, type = dataTypeInt})
    , Url.Action("cancel",address,new{id = baseObject.Id, type = dataTypeInt})
  )
)"/>
Edit
</a>

Also note the difference between @(Html.Raw()) and @Html.Raw() - you should use the latter!

Thanks, i Changed my `RouteConfig.cs` and with Your Answer Problem Solved — MABDigital, Jan 23 '14 at 13:04

score 0 · Answer 3 · answered Jan 23 '14 at 13:07

As direct assignment of events such as onClick is frowned on these days, a better way to accomplish then may be through js:

Add a hidden field for Id and dataTypeInt to your page:

@Html.HiddenFor(model=> model.Id)
@Html.Hidden("dataTypeInt ", dataTypeInt)

Add an id to your anchor:

<a href="#" style="color:#0564c1;" id ="editLink"> Edit </a>

Then your script:

<script>

     $(document).ready(function () {
           readyLinks();
     });

     readyLinks = function(){
          var id = $('#Id).val();
          var dataType = $('#dataTypeInt').val();
          var indexUrl = '/PdfInstanceEdit/index?id=' + id + '&type=' + dataType;
          var cancelUrl = '/PdfInstanceEdit/cancel?id=' + id + '&type=' + dataType;

          $('#editLink).on('click', function(){
               PopUpStart('POST','','',200,100,indexUrl, cancelUrl,'ReloadPage',true);
               return false;
          });

     };

</script>

thanks, also this Solution can be Solved my problem. – MABDigital Jan 23 '14 at 13:22 — MABDigital, Jan 23 '14 at 13:22

score 0 · Answer 4 · answered Jan 24 '14 at 17:33

A friendly reminder: if you're trying to put a Javascript string inside an HTML attribute, the value must be encoded twice. It must first be Javascript-encoded, then that result must be HTML-encoded. You could inadvertently open an XSS hole in your site if you don't perform both encodings in the correct order.

Say you have a string s that you want to display to the client. You'd write your Razor markup as:

<a href="#" onclick="alert('Hello, @HttpUtility.JavaScriptStringEncode(s)!')">Click me</a>

Note the explicit call to JavaScriptStringEncode. Then Razor's @ syntax will auto-HtmlEncode this value before writing it to the response.

How Can DeActivate Razor Html Encoding ?

4 Answers4

Also note the difference between @(Html.Raw()) and @Html.Raw() - you should use the latter!