1

I see that Firefox does NOT encode an URL like http://www.mysite.com/foo?bar=10/12/2010 when it sends a GET request. I know that URLs must be encoded, so I expected to see Firefox requesting http://www.mysite.com/foo?bar=10%2F12%2F2010 (/ = %2F). I inspected the GET requests using Wireshark.

Should the query string in the url be escaped?

I use WebHarvest and I see that when I ask it to download a page with the http directive, an URL like the one above is encoded like I expected (%2F instead of "/").

0

3 Answers 3

1

The / is allowed in plain in the query of a URI:

query       = *( pchar / "/" / "?" )

Anything else must be encoded using the percent-encoding.

6
  • @cdarwin: Yes. While reserved characters must be encoded, unreserved characters can be encoded. So inside the query / is equivalent to %2F.
    – Gumbo
    Dec 13, 2010 at 18:43
  • @Gumbo: so a site should always decode the query, right? I saw a site that doesn't do that
    – cdarwin
    Dec 13, 2010 at 18:44
  • @cdarwin: No. You can encode the / as well as it is not a reserved character (unlike in the path where / is not equivalent to %2F).
    – Gumbo
    Dec 13, 2010 at 18:45
  • @cdarwin: Yes. There is a chapter on when to encode and decode that describes this in more detail.
    – Gumbo
    Dec 13, 2010 at 18:46
  • @Gumbo: well, the text at the link you gave tells when to decoded, but it doesn't says the URI must be decoded... it says the components must be parsed before the decoding (which implies that the decoding should occur, but it's not explicit)
    – cdarwin
    Dec 13, 2010 at 18:51
0

If, by escaped, you mean URL-encoded, the short answer is yes.

There are a number of characters that are normally encoded during URL encoding but could normally appear in the URL without problem.

But sometimes the potential problems are not always obvious. I would recommend URL encoding query arguments, and decoding them from your site. After all, if you decode too many times, that should not cause any problem.

6
  • ok... but is seem really weird to see firefox not encoding the url! Why? I imagine that firefox does the right thing...
    – cdarwin
    Dec 13, 2010 at 18:34
  • To address that specific case, you'd need to be more specific about exactly where the URL is coming from. I'm still a little vague on that. Dec 13, 2010 at 18:36
  • you can type the url I wrote in the address bar and the behaviour is what I got. I think the answer of Gumbo is the correct one
    – cdarwin
    Dec 13, 2010 at 18:38
  • I'm pretty certain that no browser encodes text this way. That's not the browser's job. The browser's job is simply to navigate to the URL you enter. If you enter an invalid URL, then something might not work. It wouldn't be the browser's fault. Dec 13, 2010 at 18:44
  • You can type anything in the address bar. Try stackoverflow.com/?value=?&%nn. It's not valid but it remains unchanged (at least in my browser, Chrome). Again, it is not the job of the browser to modify addresses that you type in. Dec 13, 2010 at 19:08
0

Can't reproduce your problem.

<form>
    <input type="hidden" name="bar" value="10/12/2010">
    <input type="submit">
</form>

This displays the proper escape in address bar. Aren't you supplying this URL in an <a> element? Then you need to escape it in the HTML page yourself by either hardcoding it or utilizing the functions provided by the server side language.

2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.