Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Delimiter to use within a query string value

Tags:

I need to accept a list of file names in a query string. ie:

http://someSite/someApp/myUtil.ashx?files=file1.txt|file2.bmp|file3.doc 

Do you have any recommendations on what delimiter to use?

like image 259
Matthew Cole Avatar asked Mar 13 '09 13:03

Matthew Cole


People also ask

What is %27 in query string?

The %27 is ASCII for the single quote ( ' ) and that is a red flag for someone trying to perform SQL injection via the query string to your application's data access layer logic.

How can I include special characters in query strings?

You need to use encode special characters, see this page for a reference. If you're using PHP, there's a function to do this, called urlencode(). Show activity on this post. I did below, it works fine.

How do you write a query string?

The query string is composed of a series of field-value pairs. Within each pair, the field name and value are separated by an equals sign, " = ". The series of pairs is separated by the ampersand, " & " (or semicolon, " ; " for URLs embedded in HTML and not generated by a <form>... </form> .


2 Answers

Having query parameters multiple times is legal, and the only way to guarantee no parsing problems in all cases:

http://someSite/someApp/myUtil.ashx?file=file1.txt&file=file2.bmp&file=file3.doc 

The semicolon ; must be URI encoded if part of a filename (turned to %3B), yet not if it is separating query parameters which is its reserved use.

See section 2.2 of this rfc:

2.2. Reserved Characters

URIs include components and subcomponents that are delimited by characters in the "reserved" set. These characters are called "reserved" because they may (or may not) be defined as delimiters by the generic syntax, by each scheme-specific syntax, or by the implementation-specific syntax of a URI's dereferencing algorithm. If data for a URI component would conflict with a reserved character's purpose as a delimiter, then the conflicting data must be percent-encoded before the URI is formed.

 reserved    = gen-delims / sub-delims   gen-delims  = ":" / "/" / "?" / "#" / "[" / "]" / "@"   sub-delims  = "!" / "$" / "&" / "'" / "(" / ")"              / "*" / "+" / "," / ";" / "=" 
like image 191
Cory Kendall Avatar answered Sep 19 '22 13:09

Cory Kendall


If they're filenames, a good choice would be a character which is disallowed in filenames. Suggestions so far included , | & which are generally allowed in filenames and therefore might lead to ambiguities. / on the other hand is generally not allowed, not even on Windows. It is allowed in URIs, and it has no special meaning in query strings.

Example:

http://someSite/someApp/myUtil.ashx?files=file1.txt|file2.bmp|file3.doc is bad because it may refer to the valid file file1.txt|file2.bmp.

http://someSite/someApp/myUtil.ashx?files=file1.txt/file2.bmp/file3.doc unambiguously refers to 3 files.

like image 24
MSalters Avatar answered Sep 20 '22 13:09

MSalters