Aug 05

Query Strings in C#

Here’s a complete, copyright-free guide to Query Strings in C# / ASP.NET, including definition, examples, use cases, limitations, performance, and security. You can freely copy-paste this on your blog or Facebook page.

🔗 Query String in C# ASP.NET – Complete Guide

📘 Definition

A query string is a part of the URL that carries data from one web page to another. It starts after a ? and consists of key-value pairs, separated by &.

In ASP.NET, query strings are commonly used to pass small amounts of data between pages.

🧾 Example of a Query String

https://example.com/profile.aspx?userId=123&lang=en
  • ?userId=123&lang=en is the query string.
  • userId and lang are keys, and 123, en are values.

🧪 How to Use Query Strings in ASP.NET

🔹 Send a Query String (Redirect with Data)

Response.Redirect("Profile.aspx?userId=123&lang=en");

🔹 Read a Query String

string userId = Request.QueryString["userId"];
string lang = Request.QueryString["lang"];

Always check for null:

if (Request.QueryString["userId"] != null)
{
    int userId = int.Parse(Request.QueryString["userId"]);
}

✅ Common Use Cases

Use CaseExample
Navigation between pagesPass user ID, category ID, or search terms
Bookmarkable URLsSave filter/search settings in URL
Third-party API or link sharingShare public resources with identifiers in the URL
TrackingAdd campaign IDs, referral sources in URLs

⚙️ Limitations of Query Strings

LimitationDescription
❌ Length limitBrowsers limit URL length (commonly 2,000+ characters)
❌ Visible to userAnyone can see the data in the URL bar
❌ Not secureNever use query strings to send passwords or personal info
❌ Easy to modifyUsers can change values manually, potentially breaking logic
❌ Not suitable for large dataShould be used for small pieces of information only

🚀 Performance Impact

  • Minimal impact for small data.
  • Faster than storing in session or reading from a database for navigation logic.
  • Can increase server load if users manipulate URLs to test invalid values (requires validation).

🔐 Security Considerations

ConcernRecommendation
🔓 Data is exposedNever pass sensitive info like passwords, tokens, or IDs directly
🧪 Input tamperingAlways validate and sanitize query string values
🦠 XSS attack risksUse URL encoding and avoid rendering user input directly
🔒 Use HTTPSPrevents interception of query string in transit

✅ Example: Safe Value Handling

string name = Server.HtmlEncode(Request.QueryString["name"]);

📌 Summary Table

FeatureDescription
What is it?Part of URL carrying data in key=value format
Syntax?key1=value1&key2=value2
Stored Where?In browser URL (client side)
Size LimitAround 2000 characters (browser-dependent)
LifetimeUntil user navigates or refreshes
Secure?❌ No, unless encrypted or protected with HTTPS
Use CasesSearch filters, public IDs, navigation, analytics
Not Good ForSensitive, large, or private data

🧠 Pro Tips

  • Keep values short and URL-safe (use HttpUtility.UrlEncode() if needed).
  • Use session or POST data for more secure or larger data.
  • Combine with server-side validation to prevent misuse.

Would you like a code sample project, visual diagram, or a PDF cheat sheet on this topic? Let me know!