QueryString malformed after URLDecode

Question

I\'m trying to pass in a Base64 string into a C#.Net web application via the QueryString. When the string arrives the \"+\" (plus) sign is being replaced by a space. It appe

Answer 1

Can't you just assume a space is a + and replace it?

Request.QueryString["VLTrap"].Replace(" ", "+");

;)

Answer 2

You could manually replace the value (argument.Replace(' ', '+')) or consult the HttpRequest.ServerVariables["QUERY_STRING"] (even better the HttpRequest.Url.Query) and parse it yourself.

You should however try to solve the problem where the URL is given; a plus sign needs to get encoded as "%2B" in the URL because a plus otherwise represents a space.

If you don't control the inbound URLs, the first option would be preferred as you avoid the most errors this way.

Answer 3

The suggested solution:

Request.QueryString["VLTrap"].Replace(" ", "+");

Should work just fine. As for your concern:

I had though of this but my concern with it, and I should have mentioned this to start, is that I don't know what other characters might be malformed in addition to the plus sign.

This is easy to alleviate by reading about base64. The only non alphanumeric characters that are legal in modern base64 are "/", "+" and "=" (which is only used for padding).

Of those, "+" is the only one that has special meaning as an escaped representation in URLs. While the other two have special meaning in URLs (path delimiter and query string separator), they shouldn't pose a problem.

So I think you should be OK.

Answer 4

If you URLEncode the string before adding it to the URL you will not have any of those problems (the automatic URLDecode will return it to the original state).

Answer 5

Well, obviously you should have the Base64 string URLEncoded before sending it to the server.
If you cannot accomplish that, I would suggest simply replacing any embedded spaces back to +; since b64 strings are not suposed to have spaces, its a legitimate tactic...

Answer 6

I'm having this exact same issue except I have control over my URL. Even with Server.URLDecode and Server.URLEncode it doesn't convert it back to a + sign, even though my query string looks as follows:

http://localhost/childapp/default.aspx?TokenID=0XU%2fKUTLau%2bnSWR7%2b5Z7DbZrhKZMyeqStyTPonw1OdI%3d

When I perform the following.

string tokenID = Server.UrlDecode(Request.QueryString["TokenID"]);

it still does not convert the %2b back into a + sign. Instead I have to do the following:

string tokenID = Server.UrlDecode(Request.QueryString["TokenID"]);
tokenID = tokenID.Replace(" ", "+");

Then it works correctly. Really odd.