title: Encoding hyperlinks - when and how?
body: <p>I have a security related question. My web application allows users to input URLs. The URL is immediately stored in the database (no santization at this point. Is this wrong?). I'm using Linq to SQL so it's already parameterized. When displaying the hyperlink back to the user, I'm using a repeater. Do I need to encode the hyperlink text as well as the tooltip and href property? Or do I only have to encode the text (which is displayed). Also, I assume URL encode is what I need here, but do I also have to use HTML encode?</p>
  
  <p>I tried <code>Server.UrlEncode</code> on all three properties where the text was <code>&lt;script&gt; alert("hello") &lt;/script&gt;</code> and it seemed to mess up the href and text. I'm guessing this means that it's not fully secured?</p>
  
  <p>Edit - I should add, if I encode on output, how can I make it so that a "/" is displayed instead of "%2"?
  Thanks</p>