How to stop automatic HTML Encoding when assigning to HTML Input Fields VB.NET

Question

I have to submit a HTML form to a 3rd party website and one of the hidden fields is an XML string. The XML needs escaping before it is sent to the 3rd party.

However when I add the plain XML to the form field it semi-escapes it for me. So then when I use HTMLEncode myself part of the XML is double-escaped. How do I prevent the automatic escaping that appears to becoming from .NET.

Or even better how else can send the escaped XML via the hidden field.

XML

<systemCode>APP</systemCode>

Basic assigning to hidden input field

<systemCode>APP</systemCode>

When I HTML Encode it as well

<systemCode>APP</systemCode>

I can see what's happening - but I don't know how to prevent it?

Thanks

Answer 1

Don't use HTMLEncode as well ! Use it alone !

Something like:

'Setting value:
hdnField.Value = Server.HtmlEncode("<systemCode>APP</systemCode>")
'Outputs: &amp;lt;systemCode&amp;gt;APP&amp;lt;/systemCode&amp;gt;

'Retrieving encoded value:
Dim escaped as string = Request.Form("hdnField")
'Retrieves: &lt;systemCode&gt;APP&lt;/systemCode&gt;

'Retrieving decoded value:
Dim myValue As String = Server.HtmlDecode(Request.Form("hdnField"))
'Retrieves: "<systemCode>APP</systemCode>"

Answer 2

In the end I used a literal and then HTMLEncoding the XML string before assigned a HTML form variable to the literal text field. A little bit like below:

portalReq.Text = "<input type=""hidden"" name=""portalReq"" value='" & HTMLENCODE(RequestXML) & "' />"

Not elegant but it's circumventing the problem.