Label Text Property and entities

Question

Hi,

The following asp label fails to be displayed in the browser, can someone please tell me what I am doing wrong. I expect to see the value <abc> but instead I get nothing.

<asp:Label ID="Label1" runat="server" Text="&lt;abc&gt;"></asp:Label>

By the way, I realize that I can accomplish the same thing doing the following:

<asp:label id="Message1" runat="server"> &lt;abc&gt; </asp:Label>

But that is not really what I am asking for, what I would like to know is if using a string such as "<abc>" in an attribute value for an asp elements is allowed or not. In other words, is this an ASP.Net bug or is this behavior by design and if it’s by design what’s the reason for such design?

Thank you very much.

Answer 1

Believe it or not, but you can include entities without escaping them, thus:

<asp:Label runat="server" ID="myLabel" Text="<abc>" />

This will render an <abc> tag.

Edit: OK, sorry, you want to display the brackets, not make a tag, of course.. Using entity references in the Text attribute will give the same result - an (invisible) <abc> tag - because they are translated when the tag is parsed server-side. What you must do is:

<asp:Label runat="server" ID="myLabel" Text="&amp;lt;abc&amp;gt;" />

This will give the desired result - the &amp; entity reference will render an ampersand to the client. Followed by lt;, the result is a correct client-side entity reference (&lt;). Which will render as <.

To answer you questions explicitly: Yes, using entity references in ASP.NET attributes is (obviously) OK, since it's an XML format. This is not really a 'decision' on Microsoft's part (and certainly not a bug) - i's simply XML.

The trick is realizing when the entity references are parsed (when the tag is parsed on the server), and what the resulting text is, which is what will be sent to the client.

Answer 2

Yes it's allowed of course. Label control's purpose is to show text and markup to client. And it's really useful I think. injected code is your responsibility.

Answer 3

The asp.net aspx parser will unescape the "&lt;" and "&gt;" to "<" and ">". It will generate something like this method:

[DebuggerNonUserCode]
private Label __BuildControlLabel1()
{
  Label __ctrl = new Label();
  base.Label1 = __ctrl;
  __ctrl.ApplyStyleSheetSkin(this);
  __ctrl.ID = "Label1";
  __ctrl.Text = "<abc>";
  return __ctrl;
}

If you wanted to write it in the text property you could double escape like "&amp;lt;", but it is probably easier just to write it between start and end tags like you mention.

<asp:Label ...>&lt;abc&gt;</asp:Label>.