Question

I’m really confused how many times should I encode a URL when it is set as a value in a querystring ‘coz we know browser has their own encoding process. Here’s the scenario:

• I want to redirect to another location which I want to pass the previous URL:
  Note: the current URL is http://localhost:8081/CostMonitoring/MainMenu.aspx?Option=AllCE

Method A (without encodeURIComponent()):

window.location = 'CostEstimateApproval.aspx?CEMID=40' + 
        '&ToStatus=1CE'+
        '&PrevURL=' + window.location;

I get this in the address bar

http://localhost:8081/CostMonitoring/CostEstimateApproval.aspx?CEMID=40&ToStatus=1CE&PrevURL=http://localhost:8081/CostMonitoring/MainMenu.aspx?Option=AllCE

without encodeURIComponent(), everything works fine and the value of Request.Querystring("PrevURL") in the receiving page is

http://localhost:8081/CostMonitoring/MainMenu.aspx?Option=AllCE 

which is correct.

Method B (with encodeURIComponent()):

window.location = 'CostEstimateApproval.aspx?CEMID=40' + 
        '&ToStatus=1CE'+
        '&PrevURL=' + encodeURIComponent(window.location);

with this method I get this in the address bar:

http://localhost:8081/CostMonitoring/CostEstimateApproval.aspx?CEMID=40&ToStatus=1CE&PrevURL=http%3A%2F%2Flocalhost%3A8081%2FCostMonitoring%2FMainMenu.aspx%3FOption%3DAllCE

and the value of Request.Querystring("PrevURL") in the receiving page is

http://localhost:8081/CostMonitoring/MainMenu.aspx?Option=AllCE 

which is also decoded correctly.

My questions:

1. Should I encode the URL-as-value? Will it be redundant if I encode it then the browser encode it again?

2. or should I let the browser encode it for me? If I let the browser, will the receiving page be confused from URL-as-a-value’s value to the real URL value? Please consider this example:

   http://www.domain.com/newpage.aspx?SameName=DifferentValue&PrevURL=http://www.domain.com/oldpage.aspx?SameName=DifferentValue&PrevURL=http://www.domain.com/anypage.aspx

as you can see, both URL (the real URL and the URL-as-a-value) when not encoded has the same data name which is SameName. How does the receiving side handle this? or the HTTP server?

Thanks in advance!

Answer 1

You should use encodeURIComponent (once), since you’re encoding a url parameter.

As you noted at the end of your question, failing to encode the url with encodeURIComponent would be problematic if your url included an &, for example.

Note that your Method A only worked because your example prevUrl is somewhat simply formed, e.g. it doesn’t include a second url parameter.