Escaping XML tag contents

Question

I have a simple CAML query like

<Where><Eq><Field="FieldName"><Value Type="Text">Value text</Value></Field></Eq></Where>

And I have a variable to substitute for "Value text". What's the best way to validate/escape the text that is substituted here in the .NET framework? I've done a quick web search on this problem but all what I found was System.Xml.Convert class but this seems to be not quite what I need here.

I know I could have gone with an XmlWriter here, but it seems like a lot of code for such a simple task where I just need to make sure that the "Value text" part is formatted well.

Answer 1

use System.Xml.Linq.XElement and SetValue method. This will format the text (assuming a string), but also allows you to set xml as the value.

Answer 2

I am not sure what context the xml is coming from, but if it is stored in a string const variable that you created, then the easiest way to modify it would be:

public class Example
{
    private const string CAMLQUERY = "<Where><Eq><Field=\"FieldName\"><Value Type=\"Text\">{0}</Value></Field></Eq></Where>";

    public string PrepareCamlQuery(string textValue)
    {
        return String.Format(CAMLQUERY, textValue);
    }
}

Of course, this is the easiest approach based on the question. You could also store the xml in an xml file and read it in and manipulate it that way, like what Darren Kopp answered. That also requires C# 3.0 and I am not sure what .Net Framework you are targeting. If you aren't targeting .Net 3.5 and you want to manipulate the Xml, I recommend just using Xpath with C#. This reference goes into detail on using xpath with C# to manipulate xml, than me typing it all out.

Answer 3

You can use the System.XML namespace to do it. Of course you can also use LINQ. But I choose the .NET 2.0 approach because I am not sure which version of .NET you are using.

        XmlDocument doc = new XmlDocument();

        // Create the Where Node
        XmlNode whereNode = doc.CreateNode(XmlNodeType.Element, "Where", string.Empty);
        XmlNode eqNode = doc.CreateNode(XmlNodeType.Element, "Eq", string.Empty);
        XmlNode fieldNode = doc.CreateNode(XmlNodeType.Element, "Field", string.Empty);

        XmlAttribute newAttribute = doc.CreateAttribute("FieldName");
        newAttribute.InnerText = "Name";
        fieldNode.Attributes.Append(newAttribute);

        XmlNode valueNode = doc.CreateNode(XmlNodeType.Element, "Value", string.Empty);

        XmlAttribute valueAtt = doc.CreateAttribute("Type");
        valueAtt.InnerText = "Text";
        valueNode.Attributes.Append(valueAtt);

        // Can set the text of the Node to anything.
        valueNode.InnerText = "Value Text";

        // Or you can use
        //valueNode.InnerXml = "<aValid>SomeStuff</aValid>";

        // Create the document
        fieldNode.AppendChild(valueNode);
        eqNode.AppendChild(fieldNode);
        whereNode.AppendChild(eqNode);

        doc.AppendChild(whereNode);

        // Or you can use XQuery to Find the node and then change it

        // Find the Where Node
        XmlNode foundWhereNode = doc.SelectSingleNode("Where/Eq/Field/Value");

        if (foundWhereNode != null)
        {
            // Now you can set the Value
            foundWhereNode.InnerText = "Some Value Text";
        }

Answer 4

When working with XML, always use the XML API that works with your programming environment. Don't try to roll your own XML document building and escaping code. As Longhorn213 mentioned, in .Net all the appropriate stuff is in the System.XML namespace. Trying to to write your own code for writing XML documents will just result in many bugs and troubles down the line.

Answer 5

The problem with the System.Xml approach in my case was that it required too much code to build this simple XML fragment. I think I've found a compromise.

XmlDocument doc = new XmlDocument();
doc.InnerXml = @"<Where><Eq><Field Name=""FieldName""><Value Type=""Text"">/Value></Field></Eq></Where>";
XmlNode valueNode = doc.SelectSingleNode("Where/Eq/Field/Value");
valueNode.InnerText = @"Text <>!$% value>";

Answer 6

Use

System.Security.SecurityElement.Escape("<unescaped text>");