Question

I’m trying to pass in a Base64 string into a C#.Net web application via the QueryString. When the string arrives the ‘+’ (plus) sign is being replaced by a space. It appears that the automatic URLDecode process is doing this. I have no control over what is being passed via the QueryString. Is there any way to handle this server side?

Example:

http://localhost:3399/Base64.aspx?VLTrap=VkxUcmFwIHNldCB0byAiRkRTQT8+PE0iIHBsdXMgb3IgbWludXMgNSBwZXJjZW50Lg== 

Produces:

VkxUcmFwIHNldCB0byAiRkRTQT8 PE0iIHBsdXMgb3IgbWludXMgNSBwZXJjZW50Lg== 

People have suggested URLEncoding the querystring:

System.Web.HttpUtility.UrlEncode(yourString)  

I can’t do that as I have no control over the calling routine (which is working fine with other languages).

There was also the suggestion of replacing spaces with a plus sign:

Request.QueryString['VLTrap'].Replace(' ', '+'); 

I had though of this but my concern with it, and I should have mentioned this to start, is that I don’t know what other characters might be malformed in addition to the plus sign.

My main goal is to intercept the QueryString before it is run through the decoder.

To this end I tried looking at Request.QueryString.toString() but this contained the same malformed information. Is there any way to look at the raw QueryString before it is URLDecoded?

After further testing it appears that .Net expects everything coming in from the QuerString to be URL encoded but the browser does not automatically URL encode GET requests.

Answer 1

You could manually replace the value (argument.Replace(' ', '+')) or consult the HttpRequest.ServerVariables['QUERY_STRING'] (even better the HttpRequest.Url.Query) and parse it yourself.

You should however try to solve the problem where the URL is given; a plus sign needs to get encoded as ‘%2B’ in the URL because a plus otherwise represents a space.

If you don’t control the inbound URLs, the first option would be preferred as you avoid the most errors this way.