Disable HTML Encoding on Asp.net HyperLink attributes

Question

I have a HyperLink on my usercontrol in which I set the onlick event dynamically on the server side like this :

this.Attributes["onclick"] = string.Format("javascript:alert('{0}')", base.NavigateUrl);

The problem is that when Asp.net renders the page, it ends up with something like this

<a href='...' onclick="javascript:alert(&#39;TEST&#39;)>LINK</a>

which obviously is not valid Javascript. Using " instead of ' wouldn't help neither, the generated HTML is alert("TEST")

Is there any way around this?

Thank you.

Answer 1

onclick="javascript:alert('TEST')" is perfectly valid. When the page is parsed, entities should be replaced with their counterparts before JavaScript processes the value. So in pass 1, the HTML parser will change the attribute value to javascript:alert('TEST');, which is valid JavaScript.