Anti XSS library decode

Question

I am using microsoft anti xss library to form security. I am using HtmlFormUrlEncode method.

How can I decode my recorded data?

sample data :

mail%40sample.com
%c3%96nder  

Answer 1

AntiXSS doesn't provide a decode - the .NET framework tends to do it for you. Indeed, UrlDecode should actually get it correct.

However, if you want to do it manually should be able to create a char[] array that's the same length as the original string, then loop through the string, looking for a % and then grabbing the two characters after, ensuring they're valid hex and then doing the following to get the hex value

if ((h >= '0') && (h <= '9'))
{
    return (h - '0');
}
if (((h >= 'a') && (h <= 'f')) ||
    ((h >= 'A') && (h <= 'F')))
{
    return ((h - 'a') + 10);
}

Once you have both values you'd then combine

byte b = (byte) ((firstByte << 4) | secondByte);

And append it to the array by calling UTF8Encoding.GetChars()

(note: Code is off the top of my head and not tested properly)