IE not passing @ symbol for email input on GET form

Question

Hi guys, I'm trying to pass an email through a GET form, but in IE, it strips out the @ symbol on the page with the GET parameters. I'm using an onSubmit event, but all those do is validate the data before letting them submit, it doesn't touch any of the form values.

<form name="quick" id="ex" action="order" autocomplete="off" method="GET" onsubmit="return validateQuickForm(this);">
<input id="eMail" value="" name="email" onblur="validateField(this, VALIDATE_EMAIL, false)" type="text">
....
<input src="/images/button.gif" value="Submit" alt="Submit" title="Continue to order form" type="image">
</form>

Let's say I input [email protected]..

It should redirect me to

example.org/order/?email=user%40example.org

But it redirects me to

example.org/order/?email=userexample.org

It works fine in Firefox..

Here's the javascript function, just in case:

function validateQuickForm(form) {
    var errors = new Array();
    if (VALIDATE_EMAIL(form.email) == false) 
     errors.push("That's not a valid email!");
    if (errors.length > 0) {
     var errorMsg = "Please fill out all fields correctly:";
     for(var i = 0; i < errors.length; i++)
      errorMsg += "\r\n-"+errors[i];
     alert(errorMsg);
     return false;
    }
    return true;
}

Also, I've removed the javascript and events and it still strips out the @ regardless

Answer 1

@ before the hostname in the URL can signify authentication info. I know this support was removed from IE a while back, for security purposes, maybe they overdid it.

See e.g. http://gadgetopia.com/post/2027 and section 3.1 of http://www.ietf.org/rfc/rfc1738.txt.

Have you tried explicitly URL-encoding it before submitting the form?

Answer 2

Something else is causing your problem. If you take out your javascript, the "@" does correctly get sent in the querystring. Does the "VALIDATE_EMAIL" function ever set the value of the INPUT field? My guess is that it is stripping it out in IE.

Answer 3

Well, I just ended up using POST instead and there aren't any issues with that. IE probably filters out @ for pseudo-security reasons. I'm sure there's a work around to use GET for emails, but the alternative (POST) is much more easier and doesn't require any hacks to get around.