HtmlEncode in my .ashx

Question

How can I HtmlEncode my JSON from within my .ashx?

context.Response.Write(HtmlEncode(jsonString));

I added System.Web.HttpUtility using to the top of my .ashx but no luck

Answer 1

nevermind, I preceeded it with HttpUtility.HtmlEncode

Answer 2

I don't think HTML Encoding JSON makes any sense. If you have untrusted values in JSON object, then you html encode them before constructing JSON object.

 string fromMaliciousUser=".............";;

 string json="{'userInput':'"+HttpUtility.HtmlEncode(fromMaliciousUser)+"'}";

EDIT: I've tried this code and it returns the JSON NICELY :)

CODE IN ASHX:

    [WebService(Namespace = "http://tempuri.org/")]
    [WebServiceBinding(ConformsTo = WsiProfiles.BasicProfile1_1)]
    public class JsonReturning : IHttpHandler
    {    
        public void ProcessRequest(HttpContext context)
        {WriteJson(context);}

        private void WriteJson(HttpContext context)
        {
            IList<ImageDetails> images = 
                 GetImages();//Here you should get your images;
            //json contains Images object whose value is array ([)    
            StringBuilder sb = new StringBuilder("{'Images':[");

            //all values in array quoted in (') and separated with (,)
            string imgFmt = 
            "'<img src=\"{0}\" alt=\"{1}\" height=\"{2}px\" 
                        width=\"{3}px\" />',";

            foreach (var i in images)
            {
                sb.AppendFormat(imgFmt, i.ImageSrc, i.Title, 
                   i.Height, i.Width);
            }
            sb.Remove(sb.Length - 1, 1);//remove last ','
            sb.Append("]}");//close array (]) and object (})

            context.Response.Clear();
            context.Response.ContentType = "application/json";
            context.Response.ContentEncoding = Encoding.UTF8;
            context.Response.Write(sb.ToString());
        }

        public bool IsReusable{get{return false;}}

        private IList<ImageDetails> GetImages()
        {
            IList<ImageDetails> list = new List<ImageDetails>();
            list.Add(new ImageDetails() { ImageSrc = @"/images/image1.jpg", 
               Title = "Image1", Height = 124, Width = 124 });
            list.Add(new ImageDetails() { ImageSrc = @"/images/image2.jpg", 
               Title = "Image2", Height = 124, Width = 124 });
            list.Add(new ImageDetails() { ImageSrc = @"/images/image3.jpg", 
               Title = "Image3", Height = 124, Width = 124 });
            list.Add(new ImageDetails() { ImageSrc = @"/images/image4.jpg", 
               Title = "Image4", Height = 124, Width = 124 });
            list.Add(new ImageDetails() { ImageSrc = @"/images/image5.jpg", 
               Title = "Image5", Height = 124, Width = 124 });
            return list;
        }
    }

    internal class ImageDetails
    {
        internal string ImageSrc{get;set;}
        internal string Title { get; set; }
        internal int Height { get; set; }
        internal int Width { get; set; }
    }

HTML:

<div id="divJsonList" style="width:70%;height:200px;clear:both;border:1px solid
            blue;"></div>
<div id="jButton" style="cursor:pointer;font-weight:bolder;">Get Json</div>

<script type="text/javascript">
    $(document).ready(function() {
        $("#jButton").click(function() {
            $.ajax({
                url: 'GetImages.imj',
                type: 'POST',
                data: "{'a':'b'}",
                dataType: 'json',
                contentType: 'application/json;charset:utf-8',
                success: function(res, status) {
                    $("#divJsonList").text(res.Images);
                },
                error: function(x, s, e) {
                    alert(e);
                }
            });
        });
    });
</script>

Answer 3

I'm pretty sure that the AntiXssLibrary (version 1.5 or version 3.0 beta) has a JavaScriptEncode method: is this what you are after?