Proper way to concatenate a hyperlink into string.

Question

What would be the best way to properly concatenate string with an url inside? Can it be okay with this?

String.Format("This is the link: <a href={0}>{1}</a>", somevalue1, somevalue2)

Or it probably leaves open door for injection attacks?

So how would I insert a hyperlink within a string?

I guess I could do with HyperLink class, but then is there any property that returns html code for the class object?

Answer 1

You missed the quotes:

String.Format("This is the link: <a href=\"{0}\">{1}</a>", somevalue1, somevalue2)

Answer 2

This article talks about how to accomplish this in a secure way using HttpUtility.UrlEncode.

Answer 3

You could override the .ToString() method of the class which would return the HTML i.e.

public class Hyperlink
{
    private string url;

    public Hyperlink(string URL)
    {
        this.url = URL;
    }

    public string DisplayText { get; set; }
    public string URL { get { return this.url; } } 

    public override string ToString()
    {
        return String.Format(@"<a href=""{0}"">{1}</a>", this.url, this.DisplayText);
    }

}

Then you could do something like:

var hl = new Hyperlink("www.stackoverflow.com");
hl.DisplayText = "Stack Overflow";
var link = String.Format("This is a link: {0}", hl);

Then you can apply whichever encoding you wish to the full string if need be.

Answer 4

If you set what you get from your client to the link'!s href, it always causes a backdoor for injection attacks.

You should use HttpUtility.UrlEncode to encode querystrings of your links, to get secure links.

Answer 5

To avoid HTML injection, you would do this:

String.Format("This is the link: <a href=\"{0}\">{1}</a>",
    HttpUtility.HtmlEncode(somevalue1), HttpUtility.HtmlEncode(somevalue2))

Do not use UrlEncode for HTML values (attributes and text), because it will just look garbled. UrlEncode is for query string values, i.e. page.aspx?param=value+that+has+been+encoded

Answer 6

The below uses HyperLink and should work. However, consider whether you really need an intermediate string in the first place.

using System.Web.UI;
using System.Web.UI.WebControls;

using System.IO;

HyperLink link = new HyperLink(){NavigateUrl="http://stackoverflow.com", Text = "StackOverflow"};
StringWriter sw = new StringWriter();
HtmlTextWriter htw = new HtmlTextWriter(sw);
link.RenderControl(htw);
sw.Close();
String rendered = sw.ToString();