Adding URL-encoded '&'s as data in a URI parameter

I'm developing a client application that needs to send the '&' character in HTTP requests as data. I DO NOT want these to be interpretted as the start of a new parameter but rather would like them passed to the application as parameter data. I realize that you need to URL encode characters with special meaning. My problem is that in .NET, when you attempt to create a URI with a %26 (the URL-encoded version of '&'), it automatically converts it back to the '&' character.

So for the following URL:

http://www.targetsite.com/application parameter1=whatever&parameter2=<script>&#x6C
&#x65&#x72&#x74&#x28&#x29</script>

I need to change the '&'s in parameter2 to %26 like this:

http://www.targetsite.com/application parameter1=whatever&parameter2=%3Cscript%3E
%26%23x6C%26%23x65%26%23x72%26%23x74%26%23x28%26%23x29%3C%2F
script%3E

However, when I try to create a URI or pass the string to an HttpWebRequest .NET brings the '&'s back which looks like:

http://www.targetsite.com/application parameter1=whatever&parameter2=<script>&%23x6C
&%23x65&%23x72&%23x74&%23x28&%23x29</script>

Am I going about this the wrong way Any help would be greatly appreciated.

Thanks,
Jake

Answer this question

Adding URL-encoded '&'s as data in a URI parameter

Tyler Sample
Thanks for looking into it. My main problem is that I need to create a URI in the first place with these values. All the URI constructors seem to unescape encoded characters. Actually I lied. I need to create an HttpWebRequest instance. However, from what I understand, when you construct this (myRequest = WebRequest.Create(http://blah.whatever.com) your string ends up as a URI, which is always going to unescape certain encoded characters. So I'm back to square one which is, how do I create an HttpWebRequest instance with %26's in the URI I've looked at AbsoluteUri as well but it's a read-only property.

So the bottom line is, I've got to be doing something fundamentally wrong. I mean, why would .NET include methods like HttpUtility.UrlEncode() that converts special characters like '&' to %26 only to unescape them when I try to put the output into a URI. My only guess is that these methods are used primarilly for responses and preventing script injection attacks. I'm trying to use them for requests because my application is actually a script injection testing tool.
RGrizzzz
That's a good workaround but I'm really trying to understand what I'm doing wrong. There's got to way to create a URI that doesn't try to escape/unescape the string I feed it. There was some deprecated URI constructor method that took a boolean "dontescape" value but I'm not sure that's what I need and I'd like to do it without using deprecated methods.
dmihailescu
I looked at it a little more and it looks like the output of uri.ToString() does decode the %26 to '&'. If you use uri.AbsoluteUri instead, you get the %26 value in the returned string. ToString() usually puts the uri into a human readable form while AbsoluteUri puts it into the form that should go out on the wire.
TasneemHasAQuestion

You can try escaping the '%' before the 26. This would change "%26" into "%2526" and may be a workaround for you.
SimpleSimon
Ok, sorry, I misunderstood what you were saying. I just did a simple Ethereal sniff and it is behaving as you said, using the AbsoluteUri property. I was mistakenly paying attention to:

Console.WriteLine(myRequest.RequestUri.ToString());

rather than

Console.WriteLine(myRequest.RequestUri.AbsoluteUri);

Thanks very much for your help.

Jake
SergeK
HttpWebRequest uses AboluteUri under the covers when it is generating the request that goes out on the wire. I did some quick testing have verified this in V2.0 of the framework. Can you get a network trace and send it to me If you are using VS 2005, please read this blog, otherwise read this blog.
Adding URL-encoded '&'s as data in a URI parameter

Answer this question