Home/ Questions/Q 7819141
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-02T06:49:20+00:00

I’m using .NET 4.5 and I’m trying to parse a URI query string into

  • 0

I’m using .NET 4.5 and I’m trying to parse a URI query string into a NameValueCollection. The right way seems to be to use HttpUtility.ParseQueryString(string query) which takes the string obtained from Uri.Queryand returns a NameValueCollection. Uri.Query returns a string that is escaped according to RFC 2396, and HttpUtility.ParseQueryString(string query) expects a string that is URL-encoded. Assuming RFC 2396 and URL-encoding are the same thing, this should work fine.

However, the documentation for ParseQueryString claims that it “uses UTF8 format to parse the query string”. There is also an overloaded method which takes a System.Text.Encoding and then uses that instead of UTF8.

My question is: what does it mean to use UTF8 as the encoding? The input is a string, which by definition (in C#) is UTF-16. How is that interpreted as UTF-8? What is the difference between using UTF8 and UTF16 as the encoding in this case? My concern is that since I’m accepting arbitrary user input, there might be some security risk if I botch the encoding (i.e. the user might be able to slip through some script exploit).

There is a previous question on this topic (How to parse a query string into a NameValueCollection in .NET) but it doesn’t specifically adress the encoding problem.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    When parsing encoded values, it treats those values as UTF-8. Take the character ¢, for example. The UTF-8 encoding is C2 A2. So if it were in a query string, it would be encoded as %C2%A2.

    Now, when ParseQueryString is decoding, it needs to know what encoding to use. The default is UTF-8, meaning that the character would be decoded correctly. But perhaps the user was using Microsoft’s Cyrillic code page (Windows-1251), where C2 and A2 are two different characters. In that case, interpreting it as UTF-8 would be an error.

    If this is a user interface application (i.e. the user is entering data directly), then you probably want to use whatever encoding is defined for the current UI culture. If you’re getting this information from Web pages, then you’ll want to use whatever encoding the page uses. And if you’re writing a Web service then you can tell the users that their input has to be UTF-8 encoded.

    • 0