Question

I know the internet is loaded with information on escape characters, but I am not finding specifically what I need. I am querying inventory information from a database and the inventory descriptions can contain a wide variety of “dangerous” characters that need escaping. While I’m looping through my data reader, I need to replace all instances of any potential problem characters with the escaped version of that character. I’ve looked at Regex.Escape, but it leaves out a few key characters such as quotation marks. There is also Regex.Replace, but how do I tell it what the replace string should be if I the character it is replacing could be any number of things? How would I handle the following:

SQL Query returns the following result set for inventory descriptions:

• 3/4″ Wire
• 5′ Rope @StoreX
• 1 1\4″ Hex Nut

**I recognize there are deeper issues with the descriptions themselves, but assuming this is the data I have to work with…

SqlDataReader dr = command.ExecuteReader()
while(dr.Read())
 {
    string partDescription = dr["Description"].ToString();  //Here is where I need to escape any characters posing a potential issue
 }

Answer 1

Do you know about the Web Protection Library (formerly known as AntiXSS)? That contains a lot of escapings (HTML, Javascript, XML).