Alternative to System.Web.HttpUtility.HtmlEncode/Decode?

Question

Is there any 'slimmer' alternative to the System.Web.HttpUtility.HtmlEncode/.Decode functions in .net 3.5 (sp1)? A separate library is fine.. or even 'wanted', at least something that does not pull in a 'whole new world' of dependencies that System.Web requires.

I only want to convert a normal string into its xml/xhtml compliant equivalent (& back).

Answer 1

For XML you just have to encode the characters that have a special meaning, so you could get away with something simple like:

public static string XmlEncode(string value) {
  return value
    .Replace("<", "&lt;")
    .Replace(">", "&gt;")
    .Replace("\"", "&quot;")
    .Replace("'", "&apos;")
    .Replace("&", "&amp;");
}

public static string XmlDecode(string value) {
  return value
    .Replace("&lt;", "<")
    .Replace("&gt;", ">")
    .Replace("&quot;", "\"")
    .Replace("&apos;", "'")
    .Replace("&amp;", "&");
}

Answer 2

If possible you can "borrow" the HttpUtility class from Mono code and compile it directly a your utility assembly.

Answer 3

Although encoding might seem simple, I strongly recommend to use a library that is in wide-spread use to minimize the risk of security vulnerabilities. Microsoft's Anti-Cross Site Scripting Library provides methods for Html/Xml/Javascript escaping and the respective attribute escapes and should cover most of your web needs.

Answer 4

In .NET Framework 4.0, System.Net.WebUtility.HtmlEncode perhaps? Do note that this class is located in System.dll and not System.Web.dll.