HTML Hex Encoding

Does anyone know how and if it's possible to convert a
string like:
<div><a href="http://links.10026.com/?link=http://www.cnn.com">www.cnn.com</a></div>
<div>test string</div>
to something like this:
"\u003cdiv\u003e\u003ca href=\u0022http://www.cnn.com\u0022
\u003ewww.cnn.com\u003c/a\u003e\u003c/div\u003e\r\n\u003cdi
v\u003etest string\u003c/div\u003e"
I would like to do this using some kind of encoding
without having to escape each special character if possible
Any suggestions is greatly appreciated.
Thanksuse the HttpUtility.UrlEncode Method
Swanand Mokashi
Microsoft Certified Solution Developer (.NET)
Microsoft Certified Application Developer (.NET)
http://www.swanandmokashi.com/
http://www.swanandmokashi.com/HomePage/WebServices/
Home of the Stock Quotes, Quote of the day and Horoscope web services
"cboekhoudt" <anonymous@.discussions.microsoft.com> wrote in message
news:ca1801c438fc$e91ca860$a001280a@.phx.gbl...
> Does anyone know how and if it's possible to convert a
> string like:
> <div><a href="http://links.10026.com/?link=http://www.cnn.com">www.cnn.com</a></div>
> <div>test string</div>
> to something like this:
> "\u003cdiv\u003e\u003ca href=\u0022http://www.cnn.com\u0022
> \u003ewww.cnn.com\u003c/a\u003e\u003c/div\u003e\r\n\u003cdi
> v\u003etest string\u003c/div\u003e"
> I would like to do this using some kind of encoding
> without having to escape each special character if possible
> Any suggestions is greatly appreciated.
> Thanks
UrlEncode would give me something like
%3cdiv%3e%3ca+href%3d%22http%3a%2f%2fwww
.cnn.com%22%
3ewww.cnn. com%3c%2fa%3e%3c%2fdiv%3e%3cdiv%3etest+s
tring%3
UrlEncode is not what I need.
I need it to escape characters that are html specific such
as < > and include " '. Other than manually replace all
these with the hex, are there any special encodings that
will do it for me?
Thanks,

>--Original Message--
>use the HttpUtility.UrlEncode Method
>--
>Swanand Mokashi
>Microsoft Certified Solution Developer (.NET)
>Microsoft Certified Application Developer (.NET)
>http://www.swanandmokashi.com/
>http://www.swanandmokashi.com/HomePage/WebServices/
>Home of the Stock Quotes, Quote of the day and Horoscope
web services
>"cboekhoudt" <anonymous@.discussions.microsoft.com> wrote
in message
>news:ca1801c438fc$e91ca860$a001280a@.phx.gbl...
href=\u0022http://www.cnn.com\u0022
\u003ewww.cnn.com\u003c/a\u003e\u003c/div\u003e\r\n\u003cdi
possible
>
>.
>

HTML Hex Encoding

Does anyone know how and if it's possible to convert a
string like:

<div><a href="http://links.10026.com/?link=http://www.cnn.com">www.cnn.com</a></div>
<div>test string</div
to something like this:

"\u003cdiv\u003e\u003ca href=\u0022http://www.cnn.com\u0022
\u003ewww.cnn.com\u003c/a\u003e\u003c/div\u003e\r\n\u003cdi
v\u003etest string\u003c/div\u003e"

I would like to do this using some kind of encoding
without having to escape each special character if possible

Any suggestions is greatly appreciated.
Thanksuse the HttpUtility.UrlEncode Method

--
Swanand Mokashi
Microsoft Certified Solution Developer (.NET)
Microsoft Certified Application Developer (.NET)
http://www.swanandmokashi.com/
http://www.swanandmokashi.com/HomePage/WebServices/
Home of the Stock Quotes, Quote of the day and Horoscope web services
"cboekhoudt" <anonymous@.discussions.microsoft.com> wrote in message
news:ca1801c438fc$e91ca860$a001280a@.phx.gbl...
> Does anyone know how and if it's possible to convert a
> string like:
> <div><a href="http://links.10026.com/?link=http://www.cnn.com">www.cnn.com</a></div>
> <div>test string</div>
> to something like this:
> "\u003cdiv\u003e\u003ca href=\u0022http://www.cnn.com\u0022
> \u003ewww.cnn.com\u003c/a\u003e\u003c/div\u003e\r\n\u003cdi
> v\u003etest string\u003c/div\u003e"
> I would like to do this using some kind of encoding
> without having to escape each special character if possible
> Any suggestions is greatly appreciated.
> Thanks
UrlEncode would give me something like
%3cdiv%3e%3ca+href%3d%22http%3a%2f%2fwww.cnn.com%2 2%
3ewww.cnn.com%3c%2fa%3e%3c%2fdiv%3e%3cdiv%3etest+s tring%3
UrlEncode is not what I need.

I need it to escape characters that are html specific such
as < > and include " '. Other than manually replace all
these with the hex, are there any special encodings that
will do it for me?

Thanks,

>--Original Message--
>use the HttpUtility.UrlEncode Method
>--
>Swanand Mokashi
>Microsoft Certified Solution Developer (.NET)
>Microsoft Certified Application Developer (.NET)
>http://www.swanandmokashi.com/
>http://www.swanandmokashi.com/HomePage/WebServices/
>Home of the Stock Quotes, Quote of the day and Horoscope
web services
>"cboekhoudt" <anonymous@.discussions.microsoft.com> wrote
in message
>news:ca1801c438fc$e91ca860$a001280a@.phx.gbl...
>> Does anyone know how and if it's possible to convert a
>> string like:
>>
>> <div><a href="http://links.10026.com/?link=http://www.cnn.com">www.cnn.com</a></div>
>> <div>test string</div>
>>
>> to something like this:
>>
>> "\u003cdiv\u003e\u003ca
href=\u0022http://www.cnn.com\u0022
>>
\u003ewww.cnn.com\u003c/a\u003e\u003c/div\u003e\r\n\u003cdi
>> v\u003etest string\u003c/div\u003e"
>>
>> I would like to do this using some kind of encoding
>> without having to escape each special character if
possible
>>
>> Any suggestions is greatly appreciated.
>> Thanks
>
>.

html encoding?

Hi,
I am trying to add a "src" attribute to an iframe by code as follows:
this.MyWin.Attribute.Add("src","page1.aspx?par1=1&par2=2");

But the output page always convert the '&" into &
How can I avoid this convertion?ThanksTry eitherHtmlEncode orHtmlDecode

Html encoding SOAP response

Is there anyway I can make my xml webservice not htmlencode the response
from a call to an API?

I have:
public int PerformOperation(string operation, out string result)

The content of result is html encoded, but since it contains valid xml,
I should get away with not htmlencoding it, or not?

<soap:Body
<PerformOperationResponse xmlns="http://tempuri.org/"
<PerformOperationResult
0

</PerformOperationResult
<result
<RetrieveTreeResponse id="123"
<Node id="1"
title="TopLevelNode1"
<Node id="2"
title="2LevelNode1" /
<Node id="3"
title="2LevelNode2" /
</Node
<Node id="4"
title="TopLevelNode2" /
</RetrieveTreeResponse
</result
</PerformOperationResponse
</soap:Body
Casper Hornstrup wrote:

> Is there anyway I can make my xml webservice not htmlencode the response
> from a call to an API?
> I have:
> public int PerformOperation(string operation, out string result)
> The content of result is html encoded, but since it contains valid xml,
> I should get away with not htmlencoding it, or not?

Try to use a parameter of type XmlNode instead of a string.

> <soap:Body>
> <PerformOperationResponse xmlns="http://tempuri.org/">
> <PerformOperationResult>
> 0
> </PerformOperationResult>
> <result>
> <RetrieveTreeResponse id="123">
> <Node id="1"
> title="TopLevelNode1">
> <Node id="2"
> title="2LevelNode1" />
> <Node id="3"
> title="2LevelNode2" />
> </Node>
> <Node id="4"
> title="TopLevelNode2" />
> </RetrieveTreeResponse>
> </result>
> </PerformOperationResponse>
> </soap:Body>
>

--

Martin Honnen
http://JavaScript.FAQTs.com/

HTML encoding of asp controls.

I find that the HTML encoding of asp web controls are inconsistent.

Say, I want to show the string "<script> alter("test") <script>". For a
"BoundColumn" used in DataGrid, I get an *real alert box* instead
of the string. In order for it to be shown correctly, I have to call
"Server.HtmlEncode" before set the text.

But if I use "asp:TextBox" control, I can not do "Server.HtmlEncode"
before I set the text. Otherwise, I will see this on my web page: "<..."

Is there a general rule, or documentation of which controls will do HTML
encoding automatically, which don't?

Thanks,
Guogang

HTML encoding method?

hello,
i need to do some HTML encoding on some strings. not UrlEncoding, mind
you, but HTML encoding. ie:
"&" to "&"
"<" to "<"
...etc. does anyone know of a good way to do this, other than manual
string replacements? what of decoding back into plain text?
thanks,
mattHttpServerUtility.HtmlEncode() is what you're looking for. Here's MS
documentation on it:
http://msdn2.microsoft.com/en-gb/library/w3te6wfz.aspx
I just googled [.NET + HTMLEncode] and got over 200,000 links on this... the
above is just one of them
HTH
<matt@.mailinator.com> wrote in message
news:1171050927.250882.317160@.h3g2000cwc.googlegroups.com...
> hello,
> i need to do some HTML encoding on some strings. not UrlEncoding, mind
> you, but HTML encoding. ie:
> "&" to "&"
> "<" to "<"
> ...etc. does anyone know of a good way to do this, other than manual
> string replacements? what of decoding back into plain text?
>
> thanks,
> matt
>
On Feb 9, 2:20 pm, "Bob Johnson" <A...@.B.com> wrote:
> HttpServerUtility.HtmlEncode() is what you're looking for. Here's MS
> documentation on it:
ah sweet, thanks.

> I just googled [.NET + HTMLEncode] and got over 200,000 links on this... t
he
> above is just one of them
...i had tried some other keyword variations, didnt come up w/ the
MSDN result; but sure enough thats the documentation i needed.
thanks
matt

HTML encoding method?

hello,

i need to do some HTML encoding on some strings. not UrlEncoding, mind
you, but HTML encoding. ie:

"&" to "&"
"<" to "<"

...etc. does anyone know of a good way to do this, other than manual
string replacements? what of decoding back into plain text?

thanks,
mattHttpServerUtility.HtmlEncode() is what you're looking for. Here's MS
documentation on it:

http://msdn2.microsoft.com/en-gb/library/w3te6wfz.aspx
I just googled [.NET + HTMLEncode] and got over 200,000 links on this... the
above is just one of them

HTH

<matt@.mailinator.comwrote in message
news:1171050927.250882.317160@.h3g2000cwc.googlegro ups.com...

Quote:

Originally Posted by

hello,
>
i need to do some HTML encoding on some strings. not UrlEncoding, mind
you, but HTML encoding. ie:
>
"&" to "&"
"<" to "<"
>
...etc. does anyone know of a good way to do this, other than manual
string replacements? what of decoding back into plain text?
>
>
thanks,
matt
>

On Feb 9, 2:20 pm, "Bob Johnson" <A...@.B.comwrote:

Quote:

Originally Posted by

HttpServerUtility.HtmlEncode() is what you're looking for. Here's MS
documentation on it:

ah sweet, thanks.

Quote:

Originally Posted by

I just googled [.NET + HTMLEncode] and got over 200,000 links on this... the
above is just one of them

...i had tried some other keyword variations, didnt come up w/ the
MSDN result; but sure enough thats the documentation i needed.

thanks
matt

HTML encoding label component - best practice?

Just written a quick little custom control, decended from Label, with an
extract bool property NeedHtmlEncode, that will automatically HTML encode
the Text property.

In the Render method, I can't just use HttpUtility.HtmlEncode(Text) because
it won't deal with fonts, bold etc etc. So I wrote the following bodge to
set the Text property with the encoded value, render as normal, then reset
Text back to it's original value.

I'm sure there is a better way, can anyone help?

Thanks,

John

protected override void Render(HtmlTextWriter output)
{
if (needHtmlEncode)
{
string s = Text;
try
{
Text = System.Web.HttpUtility.HtmlEncode(Text);
base.Render(output);
}
finally
{
Text = s;
}
}
else
// normal, without encoding
base.Render(output);
}

HTML encoding in my VB

I need to implement HTML encoding in my VB program (something like
Server.HTMLEncode in ASP).

Any ideas?

Thanks,

*** Sent via Developersdex http://www.developersdex.com ***
Don't just participate in USENET...get rewarded for it!in a client VB.NET app?
Might try importing the System.Web namespace?

--
Curt Christianson
Owner/Lead Developer, DF-Software
www.Darkfalz.com

"Yuri Ch" <yuri_ch@.hotmail.com> wrote in message
news:u$6gKruAEHA.4080@.TK2MSFTNGP09.phx.gbl...
> I need to implement HTML encoding in my VB program (something like
> Server.HTMLEncode in ASP).
> Any ideas?
> Thanks,
>
>
> *** Sent via Developersdex http://www.developersdex.com ***
> Don't just participate in USENET...get rewarded for it!
VB or VB.NET?

--
Thanks,

Eric Lawrence
Program Manager
Assistance and Worldwide Services

This posting is provided "AS IS" with no warranties, and confers no rights.

"Yuri Ch" <yuri_ch@.hotmail.com> wrote in message
news:u$6gKruAEHA.4080@.TK2MSFTNGP09.phx.gbl...
> I need to implement HTML encoding in my VB program (something like
> Server.HTMLEncode in ASP).
> Any ideas?
> Thanks,
>
>
> *** Sent via Developersdex http://www.developersdex.com ***
> Don't just participate in USENET...get rewarded for it!

HTML Encoding in ASP .NET 2.0 Best Practices

I currently have a web application with hundreds of pages and controls.
There currently is no HTML Encoding done anywhere. Data to the
application come from all different places such as UI, WebServices,
Remoting and listeners that log data. All this data needs to be shown
to the user at some point and all of it can include some sort of HTML.
How in the world can I make sure that this informations is displayed
properly without allowing the HTML in the Data to mess up the HTML in
the page. Of course i have to HTML Encode the information but how do i
do that?
I have tons of pages! Do i really have to go to every possible page,
looking for every possible piece of output information and
Server.HtmlEncode it? That has to be the most painful thought i could
possibly think of :)
Maybe there is a desing principle i'm missing. Maybe if i had coded my
pages in a certain technique, all the information would have to through
certain controls, or through a certain mechanism that makes sure what
needs to be encoded is encoded and what needs to be left unencoded
remains unencoded.
Any help?
Thanks,
Markwell best practice would have been to think about this at the design of the
site.
1) which data fields are html that should be displayed as html and are
certified safe.
2) which data fields have html which should be scrubbed, remove scripting,
check for dangling tokens (say a <b> with no </b> ), imbedded forms, etc.
3)which data is just raw data and should be displayed as the characts type
(input <hi>, should be displayed as <hi> ).
all data should handling should default to #3. this means no response write
without encoding, no InnerHtml without validation. most controls will do the
correct behavior if you use the Text value.
-- bruce (sqlwork.com)
"Untitled" <markoueis@.hotmail.com> wrote in message
news:1140814406.809568.287320@.j33g2000cwa.googlegroups.com...
>I currently have a web application with hundreds of pages and controls.
> There currently is no HTML Encoding done anywhere. Data to the
> application come from all different places such as UI, WebServices,
> Remoting and listeners that log data. All this data needs to be shown
> to the user at some point and all of it can include some sort of HTML.
> How in the world can I make sure that this informations is displayed
> properly without allowing the HTML in the Data to mess up the HTML in
> the page. Of course i have to HTML Encode the information but how do i
> do that?
> I have tons of pages! Do i really have to go to every possible page,
> looking for every possible piece of output information and
> Server.HtmlEncode it? That has to be the most painful thought i could
> possibly think of :)
> Maybe there is a desing principle i'm missing. Maybe if i had coded my
> pages in a certain technique, all the information would have to through
> certain controls, or through a certain mechanism that makes sure what
> needs to be encoded is encoded and what needs to be left unencoded
> remains unencoded.
> Any help?
> Thanks,
> Mark
>

HTML Encoding in ASP .NET 2.0 Best Practices

I currently have a web application with hundreds of pages and controls.
There currently is no HTML Encoding done anywhere. Data to the
application come from all different places such as UI, WebServices,
Remoting and listeners that log data. All this data needs to be shown
to the user at some point and all of it can include some sort of HTML.

How in the world can I make sure that this informations is displayed
properly without allowing the HTML in the Data to mess up the HTML in
the page. Of course i have to HTML Encode the information but how do i
do that?

I have tons of pages! Do i really have to go to every possible page,
looking for every possible piece of output information and
Server.HtmlEncode it? That has to be the most painful thought i could
possibly think of :)

Maybe there is a desing principle i'm missing. Maybe if i had coded my
pages in a certain technique, all the information would have to through
certain controls, or through a certain mechanism that makes sure what
needs to be encoded is encoded and what needs to be left unencoded
remains unencoded.

Any help?

Thanks,

Markwell best practice would have been to think about this at the design of the
site.

1) which data fields are html that should be displayed as html and are
certified safe.
2) which data fields have html which should be scrubbed, remove scripting,
check for dangling tokens (say a <b> with no </b>), imbedded forms, etc.
3)which data is just raw data and should be displayed as the characts type
(input <hi>, should be displayed as <hi>).

all data should handling should default to #3. this means no response write
without encoding, no InnerHtml without validation. most controls will do the
correct behavior if you use the Text value.

-- bruce (sqlwork.com)

"Untitled" <markoueis@.hotmail.com> wrote in message
news:1140814406.809568.287320@.j33g2000cwa.googlegr oups.com...
>I currently have a web application with hundreds of pages and controls.
> There currently is no HTML Encoding done anywhere. Data to the
> application come from all different places such as UI, WebServices,
> Remoting and listeners that log data. All this data needs to be shown
> to the user at some point and all of it can include some sort of HTML.
> How in the world can I make sure that this informations is displayed
> properly without allowing the HTML in the Data to mess up the HTML in
> the page. Of course i have to HTML Encode the information but how do i
> do that?
> I have tons of pages! Do i really have to go to every possible page,
> looking for every possible piece of output information and
> Server.HtmlEncode it? That has to be the most painful thought i could
> possibly think of :)
> Maybe there is a desing principle i'm missing. Maybe if i had coded my
> pages in a certain technique, all the information would have to through
> certain controls, or through a certain mechanism that makes sure what
> needs to be encoded is encoded and what needs to be left unencoded
> remains unencoded.
> Any help?
> Thanks,
> Mark

html encoding dynamic link?

Hi,

don't know if this is the right category, but I think the question is pretty simple.

I've got a web user control wich contains an image tag. When the control loads, I want to set the ImageUrl property to something like this:
"~/WUC/ShowLogo.aspx?id=" + PartnerID + @dotnet.itags.org."&sz=" + Size

This page just takes the id and the given size and outputs a thumbnail from an image in the database.
Now the image doesn't show up. When I check the source of the rendered html page I see this:

<img id="ctl00_cph_pcMain_imgLogo" src="http://pics.10026.com/?src=WUC/ShowLogo.aspx?id=1&sz=75" style="border-width:0px;"/
pretty obvious where everything goes wrong.. It encodes the & tot & wich is not really a valid url..

My question: How do I stop the component, or prolly the page the component is on, from encoding the url?

Not sure what goes worng, it shouldn't encode it by default behaviour.

imgLogo.ImageURL = "/WUC/ShowLogo.aspx?id=" + PartnerID + "&sz=" + Size;

should work fine.
Can you show us the piece of code where you set the imageURL property ?

you're right, it shouldn't encode, I have no freaking idea why it won't..

code behind:

protected void Page_Load(object sender, EventArgs e)
{
imgLogo.ImageUrl = "~/WUC/ShowLogo.aspx?id=" + PartnerID + "&sz=" + Size;
lblTitle.Text = Title;
lnkInfo.NavigateUrl = @."~/Info.aspx?id=" + PartnerID;
}

page:

<table>
<tr>
<td><asp:Image runat="server" ID="imgLogo" /></td>
<td>
<asp:Label runat="server" ID="lblTitle" />
<br />
<asp:HyperLink runat="server" ID="lnkInfo">meer <asp:Image runat="server" ID="imgArrow" ImageUrl="~/media/images/doublearrow.gif" /></asp:HyperLink>
</td>
</tr>
</table
anyone got a clue?

HTML Encoding CRUD data for later display

Hi All,

This is a problem that I have resolved before by writing my own library but I would like to know if there is a better way to do this. The issue with using the library I wrote is that there is quite excess encoding that get stored in the database that I would like to avoid.

I am dealing with content entered on a fron-end using HTML textbox tag into a database and which is later read by a backend system using .NET 2.0 controls. On the backend I return write resposnes to data entered in the from end using TextBox control and I also display them using Label control.

My problem is dealing with the fact the \n \r entered do not seem to be encoded when I display data in Label Tags i.e. everything gets displayed in one long line. Is there an inbuilt way in .NET to solve this. I need to possible solution that would work in both .NET 2 and 1.1 as my solution spans both frameworks. On the Net 1.1 side I actually use HTML tags (non asp.net) so I somehow have to be able to convert my \n to <br/> and so on...

TIA,

Tuka

Hi,

Based on your description, I understand that you need to escape the carriage return \r\n to <br/> using a build-in way of .NET framework. If there is any misunderstanding, please feel free to let me know.

As far as I know, there isn't a build-in method for you to do this conversion. The only way is to write your own library to change \r\n to <br/>. This can be done by either string.Replace or Regular Expression.

Hope this helps.

Thanks for your reply. I think you understood me exactly - I'll just adapt my existing library then

Cheers,

Tuka

html encoding and the plus sign

Hi,

I am trying to pass a parameter string from one page to another. This string may contain all sorts of characters ( ie whateever may be in an encrypted string such as "+" and "=" etc etc )

I am using Request.QueryString to obtain the value - even though I am using HttpUtility.Encode and Decode, it seems that it does not preserve the "+" sign - so therefore I replace the plus sign in the original string with some unique string then after it is decoded the string has the plus signs put back in by replacing the unique string.

This works for me.

My question is:

Do I have to worry about any other characters that could be a problem that HttpUtility.Encode does not handle but have some special meaning besides the plus sign?

Thanks

-Barb

Hi,

did you already try out theUrlEncode and UrlDecode methods? These helped me out in the recent past when I had to pass the # sign in the querystring and HtmlDecode / HtmlEncode didn't really help me out. Just my 2 cents.

Grz, Kris.

Thanks for your reply

You are right Html/Encode Decode actually does not really do what I want - it may change some special characters to another representation but they are still interpreted as special characters - The ones that seem to be a problem are + " : < > # and & For these, I replace them each with a special unique string then in the receiving page replace them back to what they should be. After testing , passing all characters on the keyboard, I only seem to have a problem with these - Do you know of anything else that could be a potential problem?

thanks

Barb

Hi,

instead of creating your own code for this you could also try out the UrlEncode and UrlDecode. It really helped me out when I had problems with certain characters in the querystring. Just take 5 - 10 minutes to set up a little sample application and experiment with it.

Grz, Kris.

html encoding

I want to save an html tag in web.config,
I know it would work if i encode it by replaceing "<" to "<"
How about double quote charater ( " )?
The below line is giving errors because of it.
<add key="myHTML" value="<img src="http://pics.10026.com/?src=host.jpg">""/>
Please help
MirajDon't use ", it will work with '.
"Miraj Haq" wrote:

> I want to save an html tag in web.config,
> I know it would work if i encode it by replaceing "<" to "<"
> How about double quote charater ( " )?
> The below line is giving errors because of it.
> <add key="myHTML" value="<img src="http://pics.10026.com/?src=host.jpg">""/>
> Please help
> Miraj
>
>
> I want to save an html tag in web.config,
> I know it would work if i encode it by replaceing "<" to "<"
> How about double quote charater ( " )?
Escape it as " as per the XML specification. So, you'd have:
<add key="myHTML" value="<img src="http://pics.10026.com/?src=host.jpg">" />
[not sure why you had a pair of double quotes at the very end...]

html encoding

I want to save an html tag in web.config,

I know it would work if i encode it by replaceing "<" to "<"

How about double quote charater ( " )?

The below line is giving errors because of it.

<add key="myHTML" value="<img src="http://pics.10026.com/?src=host.jpg">""/
Please help

MirajDon't use ", it will work with '.

"Miraj Haq" wrote:

> I want to save an html tag in web.config,
> I know it would work if i encode it by replaceing "<" to "<"
> How about double quote charater ( " )?
> The below line is giving errors because of it.
> <add key="myHTML" value="<img src="http://pics.10026.com/?src=host.jpg">""/>
> Please help
> Miraj
>
> I want to save an html tag in web.config,
> I know it would work if i encode it by replaceing "<" to "<"
> How about double quote charater ( " )?

Escape it as " as per the XML specification. So, you'd have:

<add key="myHTML" value="<img src="host.jpg">" /
[not sure why you had a pair of double quotes at the very end...]