Is a php query string containing two question mark separators '?' problematic? (file.php?parm1=val1&parm2=val2?parm3=val3&...)

Question

So here's some more detail behind this question...

I have two systems from two different vendors, both proprietary. We'll call them System A and System B. Both systems function as stand alone entities, but System B provides some additional and very specific functionality lacking in System A. The vendor behind System B integrates with System A on a rather basic level (System B integrates with other vendor systems similar to System A within the same market). While System B is a php driven application, System A is not. The integration method goes something like this:

System B exports a structured control file (aka a text file) containing various parameter/value pairs. System A is designed to import the control file into System A. System A takes the data in the control file, combines it with some of it's own data, and constructs a URI. This URL is presented as a user-clickable link on the appropriate page within System A. It is this URI that contains the double '?' within the query string. This same URI contains what I can only describe as a post-back URI (a specific URI on System A to receive data back from System B, forming bi-directional communication).

So the user action of clicking the link performs the following:

Step 1: System A passes a series of parameters and values to System B within the query string to 'file.php'.

Step 2: System B receives the data from System A, performs some validation and what not, writes some information into the database, and in the process spawns a new child browser window separate from System A. The user then goes about their work within System B.

Step 3: When the user is finished with the task in System B and submits their work, System B passes a series of parameters and values back to System A via the post-back URI. System A performs some validation, writes the results into the database, then issues a command to System B to end the session (while I say session, this is not what you'd think of a true session as there's not state information) and System B closes the child window.

The majority of the time, this process works. Both vendors support this process. However, sometimes this process fails either in Step 1 or Step 3. The failure exhibits as either a hard error (as in Step 1) by System B as it doesn't receive the information it needs and expects in the query string, or an error by which System B sends its data back to System A (as in Step 3), but System A fails to retrieve the data. The latter error does not present to the user, nor does it generate any error log data. It simply doesn't exist. We only know about it after the fact when the user looks in System A for their work and there is nothing there.

And since it was already brought up, System A is performing a URL Encode/Decode on the query string data.

Since the error is intermittent, and I'm unable to replicate in my QA environment, I only have guesswork to go off of.

Answer 1

Did some quick tests in PHP because I was curious myself. Here's a list of URLs and what shows up in $_GET from each one:

http://192.168.1.200/test.php?var1=test&var2=anotherTest
array(2) { ["var1"]=> string(4) "test" ["var2"]=> string(11) "anotherTest" }

http://192.168.1.200/test.php?var1=test?var2=anotherTest
array(1) { ["var1"]=> string(21) "test?var2=anotherTest" }

http://192.168.1.200/test.php?var1=test&?var2=anotherTest
array(2) { ["var1"]=> string(4) "test" ["?var2"]=> string(11) "anotherTest" }

http://192.168.1.200/test.php?var1=test?&var2=anotherTest
array(2) { ["var1"]=> string(5) "test?" ["var2"]=> string(11) "anotherTest" }

http://192.168.1.200/test.php??var1=test&var2=anotherTest
array(2) { ["?var1"]=> string(4) "test" ["var2"]=> string(11) "anotherTest" }

So basically, the second '?' is always treated as part of the data. Could be jacking up variables names or causing other issues, dunno.

Answer 2

Yes, that will not work right. What you need to do is to use the PHP UrlEncode function to encode all values when you form an URL. That will make PHP decode the original values properly.

http://www.php.net/urlencode

If you are going to put the URL in a HTML page, for instance on a or tags, you need to also use HtmlSpecialChars after URL encode.

http://www.php.net/htmlspecialchars