Question

I have the following code in asp.net:

string backToParentFunc = string.Format("backToParent('{0}', '{1}', '{2}', '{3}');",
                                              Server.UrlEncode(login),
                                              Server.UrlEncode(firstName),
                                              Server.UrlEncode(lastName),
                                              Server.UrlEncode(email);
ScriptManager.RegisterStartupScript(this, GetType(), "backToParent", backToParentFunc, true);

Of course it stops working when the “lastName” variable contains [‘] symbol (O’Connell).
How to correctly escape strings in asp.net to make them appear correctly in JavaScript code?

Answer 1

Consider using the JavaScriptEncode method from the Microsoft Anti-Cross Site Scripting Library.