While working with encrypted querystrings in ASP.NET I noticed people doing this:

string strValues = "search term";
string strURL = "http://mysite.com?search="
+ encryptQueryString(strValues);
Response.Redirect(strURL);

string strScramble = Request.QueryString["search"];
string strdeCrypt = decryptQueryString(
<span style="color: #ff0000;">strScramble.Replace(" ", "+")</span>);

The “strScramble.Replace(” “, “+”)” is a scary way to get around the request.querystring automatically changing the “+” into a space.   A better way is to use System.Uri.EscapeDataString before adding the querystring value. Then HttpUtility.UrlDecode works as expected returning the “+”.

According to this blog on MSDN (http://blogs.msdn.com/yangxind/default.aspx), when encoding the URL use “System.Uri.EscapeDataString”, when decoding the URL use “ HttpUtility.UrlDecode“.

Of course, this is probably not going to make the SEO people at your company happy. So I will just use this when doing encryption where I actually need the + to mean + and not space.

Quick sample adding Uri.EscapeDataString and taking out replace:

string strValues = "search term";
string strURL = "http://mysite.com?search="
+ encryptQueryString(Uri.EscapeDataString(strValues));
Response.Redirect(strURL);

string strScramble = Request.QueryString["search"];
string strdeCrypt = decryptQueryString(strScramble);

NET encoding methods

There are two decoding methods in .NET