title: ASP.NET Auto Escaping Characters?
body: <p>I'm working with the following code that is contained in a .ASPX.CS page...</p>
  
  <pre><code>img = "&lt;img src=\"" + yellow + "\" align=\"middle\" onclick=\"alert('You are the current high bidder but the auction's minimum bid reserve has not been met. You need to increase your max bid until the reserve has been met to have a chance in winning this domain auction.');return false;\" class=\"sBtnImg\" alt=\"\" /&gt;";
  </code></pre>
  
  <p>It gets written to a .ASPX page within a asp:repeater using the following...</p>
  
  <pre><code>&lt;%# getAuctionFlag(Eval("AuctionAmt").ToString(), Eval("WinningBid").ToString(), Eval("UserMaxBid").ToString(), Eval("AuctionTypeDesc").ToString(), "", Eval("BidStatus").ToString())%&gt;
  </code></pre>
  
  <p>The problem I am having is that the alert contains a single quote within auction's and all my attempts to escape it have failed.  I tried \' and &#39; but .NET escapes it before it gets rendered as HTML.  So I end up with...</p>
  
  <pre><code>onclick="alert('TEXTHERE' TEXTHERE');return false;"
  </code></pre>