ASP.Net URLEncode Ampersand for use in Query String

I need to redirect to a url passing a parameter as a query string.

This can include an Ampersand in the value. such as

string value = "This & That";
Response.Redirect("http://www.example.com/?Value=" + Server.UrlEncode(value));

This however returns http://www.example.com/?Value=This+&+That

What should I be using to encode this string?

EDIT:
Thanks Luke for pointing out the obvious, the code does indeed work correctly. I Apologise, my question was not a valid question after all!

The page I was going to had a lot of old legacy code which is apparently doing some kinda of encoding and decoding itself making it appear as if my urlencode was not working.

My solution unfortunately is to completely drop use of an & until the code in question can be re-written. Don’t you just hate old code!

Answers:

Thank you for visiting the Q&A section on Magenaut. Please note that all the answers may not help you solve the issue immediately. So please treat them as advisements. If you found the post helpful (or not), leave a comment & I’ll get back to you as soon as possible.

Method 1

The documentation suggests that Server.UrlEncode should handle ampersands correctly.

I’ve just tested your exact code and the returned string was correctly encoded:

http://www.example.com/?Value=This+%26+That

Method 2

Technically doing:

value = value.Replace("&", "%26")

will do the trick.

EDIT: There seem to be some tricky issues with the whole UrlEncode/HttpEncode methods that don’t quite do the trick. I wrote up a simple method a while back that may come in handy. This should cover all the major encoding issues, and its easy to write a “desanitizer” as well.

Protected Function SanitizeURLString(ByVal RawURLParameter As String) As String

      Dim Results As String

      Results = RawURLParameter    

      Results = Results.Replace("%", "%25")
      Results = Results.Replace("<", "%3C")
      Results = Results.Replace(">", "%3E")
      Results = Results.Replace("#", "%23")
      Results = Results.Replace("{", "%7B")
      Results = Results.Replace("}", "%7D")
      Results = Results.Replace("|", "%7C")
      Results = Results.Replace("", "%5C")
      Results = Results.Replace("^", "%5E")
      Results = Results.Replace("~", "%7E")
      Results = Results.Replace("[", "%5B")
      Results = Results.Replace("]", "%5D")
      Results = Results.Replace("`", "%60")
      Results = Results.Replace(";", "%3B")
      Results = Results.Replace("/", "%2F")
      Results = Results.Replace("?", "%3F")
      Results = Results.Replace(":", "%3A")
      Results = Results.Replace("@", "%40")
      Results = Results.Replace("=", "%3D")
      Results = Results.Replace("&", "%26")
      Results = Results.Replace("$", "%24")

      Return Results

End Function

Method 3

In .net core ver 2.1 ( late 2018 ) I was able to use the following:

System.Web.HttpUtility.UrlEncode(string_to_encode)

Method 4

Another character that needs escaping is the apostrophe. Replace it with %27.

string url = Server.UrlEncode(value).Replace("'", "%27);

HttpUtility.UrlEncode() And Server.UrlEncode() do not replace this character along with a few others for backwards compatibility with other .Net Frameworks. See this microsoft article for details: http://connect.microsoft.com/VisualStudio/feedback/details/214349/httputility-urlencode-does-not-encode-apostrophe

Method 5

this is correct however if you have several parameters in the query string.

for example : &firstname=bob&secondName=”Tracy and John”

Method 6

You must use Server.UrlEncode(string containing the ampersand).

I’ve just tested it and the returned query string was correctly encoded and then decoded.

HttpUtility didn’t work for this operation.

Method 7

And if you are getting a value from a GridView the & ampersand may very well be showing up as "&":

row.Cells[4].Text.ToString() = xxxx&

So in this case you will want to use:

.Replace("&", "%26")

All methods was sourced from stackoverflow.com or stackexchange.com, is licensed under cc by-sa 2.5, cc by-sa 3.0 and cc by-sa 4.0