ASP.NET

Show an alert message box from code-behind in ASP.NET (C#)

ASP.NET · By the Postback Notes editorial team · Published 2026-08-28

"Record saved" in a browser alert box after a button click is a common request. The server cannot open a dialog itself; it writes a small script that the browser runs when the page comes back. Done properly, the message is encoded, the script runs after the page has loaded and it works inside UpdatePanels.

C# code that encodes a message and registers an alert script with ScriptManager.RegisterStartupScript
Registering an encoded alert script from a button handler.

A reusable helper

using System.Web;
using System.Web.UI;

public static class PageExtensions
{
    public static void Alert(this Page page, string message)
    {
        // JavaScriptStringEncode(…, true) adds the quotes and escapes ', ", \, line breaks and </script>
        string script = "alert(" + HttpUtility.JavaScriptStringEncode(message, true) + ");";
        // Works for full postbacks and for asynchronous postbacks (needs a ScriptManager for the latter)
        if (ScriptManager.GetCurrent(page) != null)
            ScriptManager.RegisterStartupScript(page, page.GetType(), "alert", script, true);
        else
            page.ClientScript.RegisterStartupScript(page.GetType(), "alert", script, true);
    }
}
protected void btnSave_Click(object sender, EventArgs e)
{
    if (!IsValid) return;
    Save();
    this.Alert("Record saved for " + txtName.Text + ".");
}

The encoding matters even for messages you write yourself, because they often contain user input such as a name. Without it, an apostrophe in "O'Brien" ends the string and the script fails; a crafted value could run arbitrary script.

Why not Response.Write?

// Avoid
Response.Write("<script>alert('Saved');</script>");

Response.Write during an event handler writes before the <!DOCTYPE> and <html> tags. Browsers switch to quirks mode, layouts break, and inside an UpdatePanel it corrupts the partial-page response with a parsing error. RegisterStartupScript places the script at the end of the form instead.

Alert then redirect

string script = "alert(" + HttpUtility.JavaScriptStringEncode("Order placed.", true) + ");" +
                "window.location = " + HttpUtility.JavaScriptStringEncode(ResolveUrl("~/Orders.aspx"), true) + ";";
ClientScript.RegisterStartupScript(GetType(), "done", script, true);

Do not combine this with Response.Redirect in the same request: the redirect happens on the server first and the script never reaches the browser.

The better alternative: an in-page message

alert() blocks the page, cannot be styled, and some browsers let users suppress repeated dialogs. A message rendered in the page is clearer and accessible:

<div role="status" class="notice">
    <asp:Literal ID="litStatus" runat="server" Mode="Encode" />
</div>
litStatus.Text = "Record saved for " + txtName.Text + ".";

With role="status", screen readers announce the text when it appears after an UpdatePanel refresh. Keep alerts for rare, blocking warnings.

More on running scripts from the server: Call a JavaScript function from code-behind. Asking the user to confirm instead: Show a confirm box.

Official documentation