---
title: "Explain the HttpUtility Class in C#?"  
description: "Explain the HttpUtility Class in C#?"  
author: "ICSM Computer"  
published: 2025-05-05  
updated: 2025-05-05  
canonical: https://www.mindstick.com/interview/34080/explain-the-httputility-class-in-c-sharp  
category: "c#"  
tags: ["c#"]  
reading_time: 4 minutes  

---

# Explain the HttpUtility Class in C#?

The `HttpUtility` class in C# (in **ASP.NET**) provides **helper methods for encoding and decoding URLs, HTML, and query strings**, as well as parsing request data. It's especially useful for ensuring your data is **safe for web transport** (e.g., avoiding XSS or malformed URLs).

## Namespace

```cs
using System.Web;
```

> Available in **System.Web.dll**, so it's fully supported in ASP.NET Web Forms and MVC (not in ASP.NET Core).

## Purpose of `HttpUtility`

| Category | Purpose |
| --- | --- |
| **HTML Encoding** | Prevents injection/XSS by escaping HTML tags |
| **URL Encoding** | Encodes unsafe characters for URLs |
| **Query String Parsing** | Converts a query string into a key-value collection |

## Common Methods

| Method | Description |
| --- | --- |
| `HtmlEncode(string)` | Encodes HTML (e.g., `<` becomes `<`) |
| `HtmlDecode(string)` | Decodes encoded HTML |
| `UrlEncode(string)` | Encodes URLs (e.g., `?` becomes `%3F`) |
| `UrlDecode(string)` | Decodes encoded URLs |
| `ParseQueryString(string)` | Parses a query string into a collection |
| `JavaScriptStringEncode(string)` | Encodes for safe embedding into JavaScript (to avoid breakage or injection) |

## Common Examples

### 1. HTML Encoding

```cs
string raw = "<script>alert('XSS');</script>";
string safe = HttpUtility.HtmlEncode(raw);
// Output: <script>alert('XSS');</script>
```

### 2. HTML Decoding

```cs
string encoded = "<b>Hello</b>";
string decoded = HttpUtility.HtmlDecode(encoded);  // <b>Hello</b>
```

### 3. URL Encoding/Decoding

```cs
string url = "https://site.com/search?q=hello world";
string encoded = HttpUtility.UrlEncode(url);
// https%3a%2f%2fsite.com%2fsearch%3fq%3dhello+world

string decoded = HttpUtility.UrlDecode(encoded);
```

### 4. Parse Query String

```cs
string query = "name=John&age=30";
var parsed = HttpUtility.ParseQueryString(query);

string name = parsed["name"];  // John
int age = int.Parse(parsed["age"]); // 30
```

### 5. Encode JavaScript Strings

```cs
string unsafeJs = "alert('dangerous');";
string safeJs = HttpUtility.JavaScriptStringEncode(unsafeJs);
// Output: alert(\u0027dangerous\u0027);
```

## When to Use `HttpUtility`

| Situation | Use |
| --- | --- |
| Outputting user-generated content to HTML | `HtmlEncode()` |
| Creating safe URLs or redirect strings | `UrlEncode()` |
| Reading/parsing raw query string manually | `ParseQueryString()` |
| Embedding user content inside `<script>` tags | `JavaScriptStringEncode()` |

## Summary Table

| Function | Code |
| --- | --- |
| HTML Encode | `HttpUtility.HtmlEncode("<tag>")` |
| URL Encode | `HttpUtility.UrlEncode("a b&c")` |
| Parse Query | `HttpUtility.ParseQueryString("a=1&b=2")` |
| JavaScript Encode | `HttpUtility.JavaScriptStringEncode("alert('x')")` |

## Answers

### Answer by ICSM Computer

The `HttpUtility` class in C# (in **ASP.NET**) provides **helper methods for encoding and decoding URLs, HTML, and query strings**, as well as parsing request data. It's especially useful for ensuring your data is **safe for web transport** (e.g., avoiding XSS or malformed URLs).

## Namespace

```cs
using System.Web;
```

> Available in **System.Web.dll**, so it's fully supported in ASP.NET Web Forms and MVC (not in ASP.NET Core).

## Purpose of `HttpUtility`

| Category | Purpose |
| --- | --- |
| **HTML Encoding** | Prevents injection/XSS by escaping HTML tags |
| **URL Encoding** | Encodes unsafe characters for URLs |
| **Query String Parsing** | Converts a query string into a key-value collection |

## Common Methods

| Method | Description |
| --- | --- |
| `HtmlEncode(string)` | Encodes HTML (e.g., `<` becomes `<`) |
| `HtmlDecode(string)` | Decodes encoded HTML |
| `UrlEncode(string)` | Encodes URLs (e.g., `?` becomes `%3F`) |
| `UrlDecode(string)` | Decodes encoded URLs |
| `ParseQueryString(string)` | Parses a query string into a collection |
| `JavaScriptStringEncode(string)` | Encodes for safe embedding into JavaScript (to avoid breakage or injection) |

## Common Examples

### 1. HTML Encoding

```cs
string raw = "<script>alert('XSS');</script>";
string safe = HttpUtility.HtmlEncode(raw);
// Output: <script>alert('XSS');</script>
```

### 2. HTML Decoding

```cs
string encoded = "<b>Hello</b>";
string decoded = HttpUtility.HtmlDecode(encoded);  // <b>Hello</b>
```

### 3. URL Encoding/Decoding

```cs
string url = "https://site.com/search?q=hello world";
string encoded = HttpUtility.UrlEncode(url);
// https%3a%2f%2fsite.com%2fsearch%3fq%3dhello+world

string decoded = HttpUtility.UrlDecode(encoded);
```

### 4. Parse Query String

```cs
string query = "name=John&age=30";
var parsed = HttpUtility.ParseQueryString(query);

string name = parsed["name"];  // John
int age = int.Parse(parsed["age"]); // 30
```

### 5. Encode JavaScript Strings

```cs
string unsafeJs = "alert('dangerous');";
string safeJs = HttpUtility.JavaScriptStringEncode(unsafeJs);
// Output: alert(\u0027dangerous\u0027);
```

## When to Use `HttpUtility`

| Situation | Use |
| --- | --- |
| Outputting user-generated content to HTML | `HtmlEncode()` |
| Creating safe URLs or redirect strings | `UrlEncode()` |
| Reading/parsing raw query string manually | `ParseQueryString()` |
| Embedding user content inside `<script>` tags | `JavaScriptStringEncode()` |

## Summary Table

| Function | Code |
| --- | --- |
| HTML Encode | `HttpUtility.HtmlEncode("<tag>")` |
| URL Encode | `HttpUtility.UrlEncode("a b&c")` |
| Parse Query | `HttpUtility.ParseQueryString("a=1&b=2")` |
| JavaScript Encode | `HttpUtility.JavaScriptStringEncode("alert('x')")` |


---

Original Source: https://www.mindstick.com/interview/34080/explain-the-httputility-class-in-c-sharp

Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.