Encoding on Dropdownlist items

Question

I am currently doing Encoding on Dropdownlist in our project.

Could you please review and provide your comments about the following approach? After the encoding on dropdown, if there are any special characters it is displaying in the form of encoded characters, please let me know is there any better approach than this.

// raising the databound event to to encoding
protected void ddlCountry_DataBound(object sender, EventArgs e)
{
    if (ddlCountry.Items.Count > 0)
    {

        foreach (ListItem list in ddlCountry.Items)
        {
            list.Text = EncodeDropDownItem(list.Text);
        }
    }
}

//below are the methods to do encoding
//encoding with antixss's htmlencode method
private string EncodeDropDownItem(string DropdownText)
{
    return Replacecharacters(AntiXss.HtmlEncode(DropdownText));        
}

//below method will replace the antixsstags with normal character.
private string Replacecharacters(string value)
{
    string dropdowntext;
    StringBuilder sb = new StringBuilder(value);

    sb.Replace("&", "&");
    sb.Replace("&#60;", "<");
    sb.Replace("&#62;", ">");
    sb.Replace("&#34;", "\"");
    sb.Replace("&#92;", "\\");
    return dropdowntext = sb.ToString();
}

Answer 1

A few comments -

It seems that while your code should work fine as is, it could be improved in the following ways:

A. It seems like you have three methods here when only one or two would be necessary. You may have your reasons for doing this, but the "middle-man" method "EncodeDropDownItem" seems superfluous.

B. The way you are hard-coding the calls to sb.replace, one at a time and with target/replacement values "inlined" might be more effective if they were preformed within a looping structure, with the Axss tags and replacement values retrieved from a custom dictionary. The hard-coded Axss tags and related character representations could then be encapsulated within that custom dictionary class, and re-used in other contexts if necessary.

You may have your reasons for structuring your methods the way you have. However, I make the below suggestions for your code. Note that I am not able to test this, but hopefully you or some other forum readers will catch anything I screw up here . . .

FIRST - a custom dictionary for the Axss tags/values:

    class AntiAxssDictionary : Dictionary<String, String>
    {
        public void AntiAxssDictionary()
        {
            this.Add("&#38;", "&");
            this.Add("&#60;", "<");
            this.Add("&#62;", ">");
            this.Add("&#34;", "\"");
            this.Add("&#92;", "\\");
        }
    }

THEN, a minor rearrangement of your methods (this might be a matter of taste, or function, but this is how I would do it, given what little I know about your code):

    // raising the databound event to to encoding
    protected void ddlCountry_DataBound(object sender, EventArgs e)
    {
        if (ddlCountry.Items.Count > 0)
        {
            //Initialize an AntiAxssDictionary object:
            AntiAxssDictionary tokenProvider = new AntiAxssDictionary();

            foreach (ListItem list in ddlCountry.Items)
            {
                // Encode the AntiAxss string here:
                StringBuilder sb = new StringBuilder(AntiXss.HtmlEncode(list.Text));

                // Iterate through the Axss tags stored as keys in the dictionary:
                foreach (String token in tokenProvider.Keys)
                {
                    // Attempt a replacement for each of the possible
                    // values in the Axss dictionary:
                    sb.Replace(token, tokenProvider[token]);
                }

                // Assign the new value to the list.text property:
                list.Text = sb.ToString;
            }
        }
    }

Hopefully I didn't butcher anything too badly here. I am in the midst of migrating from vb.net to C#, and learning Java at the same time. Hope that helps, and I will be interested to hear commentary and critique from other forum members.