Question

In my MVC applciation, sometimes I’m creating my querystring dynamically: once from javascript, and once from c# server code. In javascript, I’m using encodeURIComponent(value), and from the c#, I’m using HttpUtility.UrlEncode(value) method from System.Web

Suppose, I have space in the value, ex: a q:

• encodeURIComponent(value) returns a%20q
• HttpUtility.UrlEncode(value) returns a+q

Space is encoded differently, using these two methods. Is that any reason why is it working this way, different that “it was written like that long time ago and stays untouched” ?

Additionally, suppose I have plus in the value, ex: a+q

• encodeURIComponent(value) returns a%2Bq
• HttpUtility.UrlEncode(value) returns a%2bq

The js method returns upper case encoded characters, while c# one returns lower case ones.

What is the best way to cooperate in parallel with these two methods, to make the application behave in coherent way ? Shall I write alternative c# method to imitate the js method behaviour ? I suppose the decoding methods has the same differences. Is there any “correct” way work with these ?

Answer 1

Percent-encoding is defined in RFC3986. It defines that a space character is encoded as %20. However, query strings are most often in application/x-www-form-urlencoded format, which also allows encoding spaces as + instead of %20. If the decoder expects the query string in this format, then an encoder can choose whichever it prefers.

You can use the Uri.EscapeDataString Method if you want spaces always to be encoded as %20:

var result = Uri.EscapeDataString("a q");
// result == "a%20q"

On upper-case vs lower-case, RFC3986 says:

The uppercase hexadecimal digits ‘A’ through ‘F’ are equivalent to
the lowercase digits ‘a’ through ‘f’, respectively. If two URIs
differ only in the case of hexadecimal digits used in percent-encoded
octets, they are equivalent.

For consistency, URI producers and
normalizers should use uppercase hexadecimal digits for all
percent-encodings.

var result = Uri.EscapeDataString("a+q");
// result == "a%2Bq"