views:

431

answers:

2

I'm having a problem with ASP.Net mysteriously losing one of my QueryString parameters. I have URLs like the following (pasted from my browser address bar):

//Short example
http://localhost/AllAboutThatWeb/SPARQL?partialResults=True&query=SELECT%20*%20WHERE%20{%3Fs%20%3Fp%20%3Fo}&timeout=1000

//Long example
http://localhost/AllAboutThatWeb/SPARQL?query=PREFIX%20rdf%3A%20%3Chttp%3A%2F%2Fwww.w3.org%2F1999%2F02%2F22-rdf-syntax-ns%23%3E%0D%0APREFIX%20rdfs%3A%20%3Chttp%3A%2F%2Fwww.w3.org%2F2000%2F01%2Frdf-schema%23%3E%0D%0APREFIX%20xsd%3A%20%3Chttp%3A%2F%2Fwww.w3.org%2F2001%2FXMLSchema%23%3E%0D%0APREFIX%20aat%3A%20%3Chttp%3A%2F%2Fwww.dotnetrdf.org%2FAllAboutThat%2F%3E%0D%0ASELECT%20*%20WHERE%20{%3Fs%20%3Fp%20%3Fo}&timeout=1000&partialResults=True

BUT the partialResults parameter always goes missing, if I debug the application then I find that the Request.QueryString.AllKeys array does not even contain a "partialResults" key, it contains a "query" and a "timeout" key. This happens regardless of argument ordering, placing the arguments in different order still causes the partialResults parameter to dissapear.

The URLs are for an ASP.Net Generic Handler in my application and are generated by another page in my application using URL encoding to encode the data values for each parameter before Response.Redirect is used to pass the request to the Handler.

Any ideas on why the parameter goes missing?

+2  A: 

Try using partialResultz or some such instead of partialResults and check Request.QueryString.AllKeys. If it appears when you use a different name, some part of the application is extracting the parameter.

Also, never put raw SQL in places where it's editable by the user, even if it's only accessible by a small number of people. The only exceptions I can see is if you've got an application where the user is supposed to write their own SQL or if you're just writing a test application only for you.

Blixt
This is actually SPARQL which is a query language for RDF and cannot in any way alter the data in the manner that SQL could a la SQL Injection attacks which I believe is what you are alluding to in the second paragraph
RobV
Ah okay, I see.
Blixt
I'm accepting this as the answer as trying this put me onto the real cause of the issue, the URLs I posted above were being processed by my applications URL rewriting IHttpModule and URLs of that form only had their query and timeout parameters passed to the real URL of the Generic Handler. So regardless of what other parameters I added and their names they weren't passed through
RobV
A: 

"Default Timeout=4;" write it into connection string(in seconds)

Harun