On the coding problem of URL parameters in Web development engineering

Recently in the project, in the Velocity developed page template using a tag to create a link, and with the need to submit the parameters (this is not used here because the template generated by the email, sent to the customer, because the customer's email client may be HTTPS, And the link above the template is not to jump to HTTPS site, using form will cause the browser this kind of hybrid link. When the page generated by the template to jump, found that the parameters of the link submission has changed, in particular, when the parameter is submitted is a string containing 10-bit arbitrary output characters, the string has a "+" character, after submission after the background "+" character disappeared, replaced by a space. By firebug the parameters of the process of observing the condition, it is found that the parameters have changed before the background receives the wrong parameters. This problem occurs because we use a tag when we build the link on velocity, and the parameter is directly following the link address without URL encoding:

<href= "$repayUrl/test!test.action?param1=$!param1&param2=$!param2"  >            click me        </a>

A tag created by the link contains the parameters param1 and param2, and the specific parameter values are generated from the background, param2 is the problem of the parameters, the solution is to generate the URL process, the parameter URL encoding, velocity comes with the coding tool Org.apache.velocity.tools.generic.EscapeTool, url-encode the parameters,

<a href= "$repayUrl/test!test.action?param1=$!param1&param2= $esc. URL ($!param2)" >

            Click Me
</a>

This assumes that the ESC is a reference to the Escapetool, which, of course, should be placed in the template engine before use

This parameter param2 can be correctly submitted, we do not encode param1, because we determine that param1 is an integer type, in fact, the most secure method is to encode the entire URL.

Also, people using the STRUTS2 label Development page have experience using <S:A > tags, which makes it easy to build a URL that meets the requirements, possibly because the tag already encodes the URL. However, if you use the HTML a tag, you should note that the parameters must be URL-encoded, or submitted must be wrong.

On the coding problem of URL parameters in Web development engineering