Explain the HttpUtility Class in C#?

Question

ICSM Computer · Answer

The HttpUtility class in C# (in ASP.NET) provides
helper methods for encoding and decoding URLs, HTML, and query strings, as well as parsing request data. It's especially useful for ensuring your data is
safe for web transport (e.g., avoiding XSS or malformed URLs).
Namespace
using System.Web;
Available in System.Web.dll, so it's fully supported in ASP.NET Web Forms and MVC (not in ASP.NET Core).
Purpose of HttpUtility
Category
Purpose
HTML Encoding
Prevents injection/XSS by escaping HTML tags
URL Encoding
Encodes unsafe characters for URLs
Query String Parsing
Converts a query string into a key-value collection
Common Methods
Method
Description
HtmlEncode(string)
Encodes HTML (e.g., andlt; becomes andlt;)
HtmlDecode(string)
Decodes encoded HTML
UrlEncode(string)
Encodes URLs (e.g., ? becomes %3F)
UrlDecode(string)
Decodes encoded URLs
ParseQueryString(string)
Parses a query string into a collection
JavaScriptStringEncode(string)
Encodes for safe embedding into JavaScript (to avoid breakage or injection)
Common Examples
1. HTML Encoding
string raw = "andlt;scriptandgt;alert('XSS');andlt;/scriptandgt;";
string safe = HttpUtility.HtmlEncode(raw); 
// Output: andlt;scriptandgt;alert(and#39;XSSand#39;);andlt;/scriptandgt;
2. HTML Decoding
string encoded = "andlt;bandgt;Helloandlt;/bandgt;";
string decoded = HttpUtility.HtmlDecode(encoded);  // andlt;bandgt;Helloandlt;/bandgt;
3. URL Encoding/Decoding
string url = "https://site.com/search?q=hello world";
string encoded = HttpUtility.UrlEncode(url); 
// https%3a%2f%2fsite.com%2fsearch%3fq%3dhello+world
string decoded = HttpUtility.UrlDecode(encoded);
4. Parse Query String
string query = "name=Johnandage=30";
var parsed = HttpUtility.ParseQueryString(query);
string name = parsed["name"];  // John
int age = int.Parse(parsed["age"]); // 30
5. Encode JavaScript Strings
string unsafeJs = "alert('dangerous');";
string safeJs = HttpUtility.JavaScriptStringEncode(unsafeJs);
// Output: alert(\u0027dangerous\u0027);
When to Use HttpUtility
Situation
Use
Outputting user-generated content to HTML
HtmlEncode()
Creating safe URLs or redirect strings
UrlEncode()
Reading/parsing raw query string manually
ParseQueryString()
Embedding user content inside andlt;scriptandgt; tags
JavaScriptStringEncode()
Summary Table
Function
Code
HTML Encode
HttpUtility.HtmlEncode("andlt;tagandgt;")
URL Encode
HttpUtility.UrlEncode("a bandc")
Parse Query
HttpUtility.ParseQueryString("a=1andb=2")
JavaScript Encode
HttpUtility.JavaScriptStringEncode("alert('x')")
and

Method	Description
`HtmlEncode(string)`	Encodes HTML (e.g., `<` becomes `<`)
`HtmlDecode(string)`	Decodes encoded HTML
`UrlEncode(string)`	Encodes URLs (e.g., `?` becomes `%3F`)
`UrlDecode(string)`	Decodes encoded URLs
`ParseQueryString(string)`	Parses a query string into a collection
`JavaScriptStringEncode(string)`	Encodes for safe embedding into JavaScript (to avoid breakage or injection)

interview

Explain the HttpUtility Class in C#?

ICSM Computer

Can you answer this question?

1 Answers

Namespace

Purpose of `HttpUtility`

Common Methods

Common Examples

1. HTML Encoding

2. HTML Decoding

3. URL Encoding/Decoding

4. Parse Query String

5. Encode JavaScript Strings

When to Use `HttpUtility`

Summary Table

Liked By

Category	Purpose
HTML Encoding	Prevents injection/XSS by escaping HTML tags
URL Encoding	Encodes unsafe characters for URLs
Query String Parsing	Converts a query string into a key-value collection

Situation	Use
Outputting user-generated content to HTML	`HtmlEncode()`
Creating safe URLs or redirect strings	`UrlEncode()`
Reading/parsing raw query string manually	`ParseQueryString()`
Embedding user content inside `<script>` tags	`JavaScriptStringEncode()`

Function	Code
HTML Encode	`HttpUtility.HtmlEncode("<tag>")`
URL Encode	`HttpUtility.UrlEncode("a b&c")`
Parse Query	`HttpUtility.ParseQueryString("a=1&b=2")`
JavaScript Encode	`HttpUtility.JavaScriptStringEncode("alert('x')")`