Question

Is the ampersand the only character that should be encoded in an HTML attribute?

It’s well known that this won’t pass validation:

<a href="http://domain.com/search?q=whatever&lang=en"></a>

Because the ampersand should be &. Here’s a direct link to the validation fail.

This guy lists a bunch of characters that should be encoded, but he’s wrong. If you encode the first “/” in http:// the href won’t work.

In ASP.NET, is there a helper method already built to handle this? Stuff like Server.UrlEncode and HtmlEncode obviously don’t work – those are for different purposes.

I can build my own simple extension method (like .ToAttributeView()) which does a simple string replace.

Answer 1

Other than standard URI encoding of the values, & is the only character related to HTML entities that you have to worry about simply because this is the character that begins every HTML entity. Take for example the following URL:

http://query.com/?q=foo&lt=bar&gt=baz

Even though there aren’t trailing semi-colons, since &lt; is the entity for < and &gt; is the entity for >, some old browsers would translate this URL to:

http://query.com/?q=foo<=bar>=baz

So you need to specify & as &amp; to prevent this from occurring for links within an HTML parsed document.