Difference between request. querystring ("ID") and request ("ID") and encoding issues that need attention

From: http://www.cnblogs.com/qyz123/archive/2006/12/11/589221.html

Difference between request. querystring ("ID") and request ("ID ")

If you encounter a problem twice a day, copy it for your reference. Generally, the omnipotent request ("ID") is better.

The request reads data from several sets in order. The order from the beginning to the end is querystring, form, and servervariables. The request object searches for the variables in these sets in order of this order. If there is any matching variable, it will be aborted and the subsequent variables will be ignored.

Now let's analyze your problem.
Suppose there is a page named test. asp? Id = 111
Here, we use the get method for the page. request. querystring ("ID") is the same as request ("ID"). If you do not specify a set of requests, the querystring will be searched first.

If our page uses the POST method to send data to test. ASP, then request. querystring ("ID") is useless (he can only get), but must use request. from ("ID"), and if you still use request ("ID"), he can also obtain data, but first checks the value of querystring, it is obviously slow.

The following is an example of Detection:
<%
If request ("Submit") <> "then
Response. Write "get directly:" & request ("username") & "<br>"
Response. Write "get:" & request. querystring ("username") & "<br>"
Response. Write "get post:" & request. Form ("username") & "<br>"
End if
%>
<Form name = form1 action = "" method = post>
<Input type = test name = "username" value = "postuser">
<Input type = submit name = "Submit" value = "test">
</Form>

 

From http://blog.joycode.com/ghj/archive/2007/12/07/112382.aspx

Encoding Problems When request. querystring is used to accept parameters 

 

Let's take a look at the following requests to see what information is received on the. ASPX page using request. querystring?

	Page url	Request. querystring ["info"] accepted value
Case 1	A. aspx? Info = % 25	%
Case 2	A. aspx? Info = % BC % Ca % F5	????

Situation analysis:

Case 1

A. aspx? Info = % 25 why request. querystring ["info"] The received value is %, instead of % 25, because the request. querystring decodes the URL after receiving the value. Httputility. urldecode ("% 25") is calculated as %

The above case 1 seems very simple. However, in some special scenarios, we are very depressed.

For example:

You have your own encryptionAlgorithmIn some cases, this encryption algorithm calculates the result with a percent sign, and you need to pass this result to other pages through URL parameters.
At this time, you may find that a function cannot be used in some cases.

What if the problem is solved?

Solution 1:

Make httputility. urlencode before passing the parameters to be passed,
Remember that the urlencode is encoded according to the UTF-8. In this case, if we want the client to accept % 25, we should pass % 2525.

Remember, you cannot perform urlencode once after each acceptance by the receiver. Instead, urlencode is performed on the sender.
If the receiver accepts the request as urlencode, the following situation occurs:
The sender sends a. aspx? Info = % 25. In this case, if the receiver accepts the URL, everything is correct.
The sender sends a. aspx? Info = %. At this time, if the receiver accepts the request and then uses urlencode, it will be messy.

In this solution, remember that the number of urlencode and urldecode must match one by one. It cannot be more than once, or less than once.
Some people will say that the number of times does not match? For example, in the following case, if you do not pay attention to it, the number of occurrences may not match. This is not what you expect.
For example, we have the following features:

A. ASPX page automatically jumps to the page set by the from parameter (request. querystring ["from"] to accept this parameter) based on the input from parameter.
B. The ASPX page is also the same logic. It automatically jumps to the specified page based on the input from parameter (request. querystring ["from"] to accept this parameter.
The C. ASPX page is also the same logic. Based on the input from parameter (this parameter is accepted by request. querystring ["from"]), the page is automatically redirected to the specified page.

In this way, we may write the following link address:
A. aspx? From = B. aspx
A. aspx? From = B. aspx? From = C. aspx
A. aspx? From = B. aspx? From = C. aspx? From = http://blog.joycode.com/ghj/

The following is a little more complicated. I will give the following links, all of which have the parameter. Please tell me which page has accepted the parameter?
Htt: httputility. urlencode ("&") = "% 26" httputility. urlencode ("%") = "% 25"

Address	The a parameter will be accepted by the page
A. aspx? From = B. aspx? From = C. aspx & A = 1	The a parameter is accepted by the. ASPX page.
A. aspx? From = B. aspx? From = C. aspx % 26a = 1	The a parameter is accepted by the B. ASPX page.
A. aspx? From = B. aspx? From = C. aspx % 2526a = 1	The a parameter is accepted by the C. ASPX page.

If you do not want to understand it, think about the following sentence:
Httputility. urldecode is performed every time request. querystring is used to obtain parameters.

Solution 2:

Instead of request. querystring, You can implement a method to obtain query parameters. I will tell you the details after I finish the case 2, because this solution also handles some situations in Case 2.

Case 2

A. aspx? Info = % BC % Ca % F5 the information sent to us is actually the two Chinese characters "technology" after gb2312 encoding.
Believe it or not, you can use the following expression to calculate the result: % BC % Ca % F5
Httputility. urlencode ("technology", system. Text. encoding. getencoding ("gb2312 "))

Inside the Asp.net system, when dealing with request. querystring and other situations, are using the UTF-8 encoding, if we do not have the problem of coexistence of multiple systems, this problem does not exist at all.
However, when you need to interact with other systems, the problem may occur.
If you do not know the case 2, you will be troubled by this problem.

For example, the following two addresses are mentioned:

The server. urlencode function in Asp.net is different from the value returned by the server. urlencode function in ASP.
Http://blog.joycode.com/ghj/archive/2003/10/20/2992.aspx

How do I transmit Chinese characters between PHP and aspx through URLs?
Http://topic.csdn.net/u/20071018/19/8a4066af-a08c-4214-91e9-ed4caf977e07.html

Solution of Case 2
Use the httputility. parsequerystring function with Encoding

Is similar to the followingCodeTo obtain the query text parameters in the specified format.

System. Collections. Specialized. namevaluecollection NV =
System. Web. httputility. parsequerystring (request. url. query, system. Text. encoding. getencoding ("gb2312 "));
Response. Write (NV ["tag"]);

 

I want to explain why I know the above solutions because I used reflector to read the implementation code of request. querystring. When viewing the code, we will see an internal method:
Internal methods of the system. Web. httpvaluecollection class:
Internal void fillfromstring (string S, bool urlencoded, encoding)

This internal method implements the function of decrypting query parameters as needed. Unfortunately, in the querystring processing function, when querystring is forcibly specified, httputility. urldecode must be performed once. See the following code:

Public static namevaluecollection parsequerystring (string query, encoding)
{
...
Return new httpvaluecollection (query, false, true, encoding );
}

If we do not want to use solution 1 of Case 1, we need to write a code to parse the query information. We can rewrite it by copying the internal void fillfromstring (string S, bool urlencoded, encoding) method of the system. Web. httpvaluecollection class. But it is depressing: If you use reflector to check the implementation of this function, the code from reflector is wrong. The correct method is as follows: it was completed with the help of Shi fan.

Self-implemented method to parse the required text from the URL query text Query

///

/// parse the query text in the URL into a namevaluecollection.
/// with the help of the Assembly head, Guo hongjun adapted it from system. web. internal methods of the httpvaluecollection class:
// internal void fillfromstring (string S, bool urlencoded, encoding)
///
/// query text to be parsed
// whether URL Decoding is required when parsing text
// when parsing text, decoding Based on the URL encoding
//
Public static namevaluecollection fillfromstring (string query, bool urlencoded, encoding)
{< br> namevaluecollection querystring = new namevaluecollection ();
If (string. isnullorempty (query)
{< br> return querystring;
}

// Make sure that the first character of the query text is not?
If (query. startswith ("? "))
{
Query = query. substring (1, query. Length-1 );
}

Int num1 = (query! = NULL )? Query. Length: 0;
// Traverse each character
For (INT num2 = 0; num2 <num1; num2 ++)
{
Int num3 = num2;
Int num4 =-1;
While (num2 <num1)
{
Switch (Query [num2])
{
Case '= ':
If (num4 <0)
{
Num4 = num2;
}
Break;
Case '&':
Goto breakwhile;
}
Num2 ++;
}

Breakwhile:

string name = NULL;
string val = NULL;
If (num4> = 0)
{< br> name = query. substring (num3, num4-num3);
val = query. substring (num4 + 1, (num2-num4)-1);
}< br> else
{< br> val = query. substring (num3, num2-num3);
}< br> If (urlencoded)
{

Querystring. Add (httputility. urldecode (name, encoding), httputility. urldecode (Val, encoding ));
}
Else
{
Querystring. Add (name, Val );
}
If (num2 = (num1-1) & (Query [num2] = '&'))
{
Querystring. Add (null, String. Empty );
}
}

Return querystring;

}

With the above code, we can parse the query parameters as needed, rather than using request. querystring.

Summary

Request. querystring for us: Every time after receiving the parameter, urlencode is done, and urlencode is encoded according to the UTF-8. In most cases, there is no problem, but in some cases, it will bring us trouble. This article will analyze the scenarios that may bring us trouble and solutions.

References:

Use reflector; a reflector bug encountered when viewing code
Http://blog.joycode.com/ghj/archive/2006/12/06/88646.aspx

Decrypts parameters of different codes.
Http://blog.joycode.com/ghj/archive/2006/04/19/74894.aspx