I have a form with method="get". In the form I need to pass the URL of a CSS file but it is encoding it to http%3A%2F%2Fwww... etc.
Is there a way to stop the encoding of the URL as it is breaking the file.
Thanks
- What server side language are you using to parse the GET request? You will need to decode the URL (most server side languages have this built in)Rowan– Rowan2010-06-01 11:39:19 +00:00Commented Jun 1, 2010 at 11:39
Add a comment |
6 Answers
Background
It's a bit more subtle than one might think at first sight. For any URL, which is a specific form of the URI standard, certain characters are special. Among the special characters are `:` (scheme separator) and `/` (path or hierarchy separator), here's the full list of reserved symbols from [RFC-2396][1]:reserved = ";" | "/" | "?" | ":" | "@" | "&" | "=" | "+" | "$" | ","
It has little to do with security, much more with simply following a standard: these symbols mean something special in any URI, URL or URN. When you need to use them as part of a path or a querystring (the GET request creates a query string for you), you need to escape them. The short version of escaping is: take the UTF-8 bytes as hexadecimal and precede them with a % sign. In the case of the reserved characters, that's always a single-byte character in UTF-8 and thus escaped as two hex digits.
Path to a solution
Back to your problem. You didn't mention what language you were using. But any language that works with the internet has a way of encoding or decoding URLs. Some have helper functions to decode an entire URL, but normally you are better of splitting it into a name/value pairs and then decoding it. This will give you the absolute URL-path you need.Note: it is best to always decode query values, simply because when people type in a value, they won't know whether that value is reserved, and the browser will encode it for you. Not doing so poses a security risk.
EDIT: When you need to decode within a page, not on the server side, you're going to need JavaScript to do the job. Have a look at this page for en/decoding URLs, or use Google to find many others.
2 Comments
kristina
becuase I am passing the value to an iframe I cannot decode on that end. All I need to do is pass the css path <input type="hidden" name="css" value="site/css/basket.css" /> But this is then passed as an encoded path and not picked up?
Abel
@kristina: what happens on the receiving end of the chain? I.e., you've set a URL in the target-attribute of the
<iframe> element. That page must know how about the CSS-parameter, the name, and how to access the value. Just applying some hidden input field with the name "css" is not going to magically change the css stylesheet of the page, unless the page is programmed to do so.No, you can't. The encoding is required to make a valid URL.
Instead, decode the value in your receiving code (what platform are you on anyways, URL decoding is usually done automatically for you)
2 Comments
kristina
I am posting to an iframe, that is the problem, from just an html page
Matti Virkkunen
@kristina: I don't see how that makes any difference
If you used XMLHttpRequest you can send text without encoding. You can use JavaScript to do that, but remember to set content-type to text/plain.
content-type: text/plain 
Comments
No for security reason you can't do this. You have to collect and decode it at the receiving end.
Comments
When you use FORM and GET method and some special chars, you will end up with browser encoding the resulted query. For newer browsers that support changing the URL address without refreshing the page (IE10+), is possible to decode the URL query string and update the address.
I'm using a script like this:
<script type="text/javascript"> if (history.pushState) { //IE10+ var newurl = window.location.protocol + "//" + window.location.host + window.location.pathname + decodeURIComponent(window.location.search); window.history.pushState({path:newurl},'',newurl); } </script> This will transform a http://example.com/page.html?path=foo%2Fbar back to http://example.com/page.html?path=foo/bar
Comments
You can decode the url using javascript Function: decodeURIComponent(Url ); Because Browser encodes the Url for special characters . For example : https://www.example.com is encoded to %20https%3A%2F%2Fwww.example.com. Here the special characters are replaced by % and its ASCI value.
