in razor how to have a link to an external url from the database

Question

in my razor page I have.

<p>
    <span>Website: </span>
    <span>
        <a href="@(Url.Encode(Model.PrimaryInfo.WebsiteUrl))" target="_blank">@Model.PrimaryInfo.WebsiteUrl</a>
    </span>
</p>

when I inspect the element I see. the page displays as

Website: https://www.mywebsite.org/

when I inspect element I get

<a href="https%3a%2f%2fwww.mywebsite.org%2f" target="_blank">https://www.mywebsite.org/</a>

and when I click the link I get

[HttpException (0x80004005): A potentially dangerous Request.Path value was detected from the client (:).]
System.Web.HttpRequest.ValidateInputIfRequiredByConfig() +9939972
System.Web.PipelineStepManager.ValidateHelper(HttpContext context) +53

still get potentially dangerous request without the url.encode — Bryan Dellinger, Sep 18 '18 at 16:38
This is extraordinarily dangerous but you should be able to just [Html.Raw()](https://msdn.microsoft.com/en-us/library/gg480740(v=vs.118).aspx) the value out. [Be really careful here, Raw() is extraordinarily dangerous](https://kevinchalet.com/2018/01/09/why-you-should-never-use-html-raw-in-your-razor-views/). [Dangers](https://stackoverflow.com/questions/31463823/prevent-xss-attacks-and-still-use-html-raw) and google more, please understand what it does. — Erik Philips, Sep 18 '18 at 18:18

score 1 · Answer 1 · answered Sep 18 '18 at 16:23

Try to use this

public static class LinkHelper{
public static string ExternalLink(this HtmlHelper helper, string url, string text)
    {
        return String.Format("<a href='http://{0}' target="_blank">{1}</a>", url,text);
}}

and in view

@Html.ExternalLink("www.google.com", "Google")

score 1 · Answer 2 · edited Sep 19 '18 at 02:12

Here is your checklist:

Non-unicode datatype not used: validate that you are storing URLs in the database as an NVarChar type and don't use VarChar
No need to encode: remove the encoding.
Validate that you are not violating request validation scheme as per .Net. Please refer to hanslman article: https://www.hanselman.com/blog/ExperimentsInWackinessAllowingPercentsAnglebracketsAndOtherNaughtyThingsInTheASPNETIISRequestURL.aspx

in razor how to have a link to an external url from the database

2 Answers2