Encoding apostrophe

Question

i am building up a string on the server that is getting put into a javascript variable on the client.

what is the best of encoding this to avoid any issues

right now on the server i am doing something like this:

 html = html.Replace("'", "'");

but i assume there is a more elegant fool proof way of doing stuff like this.

Answer 1

You're really better off using the Microsoft Anti-Cross Site Scripting Library to do this. They provide a JavaScriptEncode method that does what you want:

Microsoft.Security.Application.AntiXss.JavaScriptEncode("My 'Quotes' and ""more"".", False)