ASP.NET

Member 8761667 wrote:

What could be the problem here, please?

Response.Redirect("~/success.aspx?Data=" & Server.UrlEncode(username.Text))

Public Class success
    Inherits System.Web.UI.Page

    Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load

        If Request("Name") IsNot Nothing Then
             Name.Text = String.Format("{0}, ", Request("Name"))
        End If

    End Sub

End Class

Imports System
Imports System.Web
Imports System.IO

Class MyNewClass
   Public Shared Sub Main()
      Dim myString As String
      Console.WriteLine("Enter a string having '&' or '""'  in it: ")
      myString = Console.ReadLine()
      Dim myEncodedString As String 
      ' Encode the string.
      myEncodedString = HttpUtility.HtmlEncode(myString)
      Console.WriteLine("HTML Encoded string is " + myEncodedString)
      Dim myWriter As New StringWriter()
      ' Decode the encoded string.
      HttpUtility.HtmlDecode(myEncodedString, myWriter)
      Console.Write("Decoded string of the above encoded string is " + myWriter.ToString())
   End Sub 'Main
End Class 'MyNewClass

Public Class success
    Inherits System.Web.UI.Page

    Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load
        
        ' Store this in a local variable, so you're not repeatedly looking up the same item.
        ' Also, use Request.QueryString("Name") instead of Request("Name"), as you already know it's in the query string.
        Dim theName As String = Request.QueryString("Name")
        
        ' The value might be Nothing, or it might be an empty string:
        If Not String.IsNullOrEmpty(theName) Then
             
             ' Encode the value to display as text within an HTML context:
             Name.Text = HttpUtility.HtmlEncode(theName)
        End If

    End Sub

End Class

Response.Redirect(String.Format("success.aspx?name={0}", UserNameTextBox))

Dim theName As String = UserNameTextBox.Text
Dim encodedName = HttpUtility.UrlEncode(theName)
Response.Redirect(String.Format("success.aspx?name={0}", encodedName))

Dim target = String.Format("~/Success.aspx?Name={0}", username.Text)
        ' Perform your Redirect '
        Response.Redirect(target, True)

Public Class success
    Inherits System.Web.UI.Page

    Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load

        If Request("Name") IsNot Nothing Then
            ' It exists, so set your label (and a trailing comma) to display your name '
            Name.Text = String.Format("{0}, ", Request("Name"))
        End If

    End Sub

End Class

Dim name As String = HttpUtility.UrlEncode(username.Text)
Dim target As String = String.Format("~/Success.aspx?Name={0}", name)
Response.Redirect(target, True)

Public Class success
    Inherits System.Web.UI.Page

    Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load

        Dim theName As String = Request.QueryString("Name")
        If Not String.IsNullOrEmpty(theName) Then
            Dim encodedName As String = HttpUtility.HtmlEncode(theName)
            Name.Text = String.Format("{0}, ", encodedName)
        End If

    End Sub

End Class

Dim target = String.Format("~/Success.aspx?Name={0}", username.Text)
        ' Perform your Redirect '
        Response.Redirect(target, True)

Public Class success
    Inherits System.Web.UI.Page

    Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load

        If Request("Name") IsNot Nothing Then
            ' It exists, so set your label (and a trailing comma) to display your name '
            Name.Text = String.Format("{0}, ", Request("Name"))
        End If

    End Sub

End Class

Richard Deeming wrote:

it is to prevent a cross-site scripting (XSS)[^] attack.

yourInsertCommand.Parameters.AddWithValue("@StartDate", DateTime.Now);