Server.UrlEncode(string s)... doesn't

Question

Server.UrlEncode("My File.doc") returns "My+File.doc", whereas the javascript escape("My File.doc") returns "My%20File.doc". As far as i understand it the javascript is corectly URL encoding the string whereas the .net method is not. It certainly seems to work that way in practice putting http://somesite/My+File.doc will not fetch "My File.doc" in any case i could test using firefox/i.e. and IIS, whereas http://somesite/My%20File.doc works fine. Am i missing something or does Server.UrlEncode simply not work properly?

Answer 1

A + instead of a space is correct URL encoding, as would escaping it to %20. See this article (CGI Programming in Perl - URL Encoding).

The + is not something that JavaScript can parse, so javascript will escape the space or + to %20.

Answer 2

Use Javascripts encodeURIComponent()/decodeURIComponent() for "round-trip" encoding with .Net's URLEncode/URLDecode.

EDIT

As far as I know, historically the "+" has been used in URL encoding as a special substitution for the space char ( ASCII 20 ). If an implementation does not take the space into consideration as a special character with the '+' substitution, then it still has to escape it using its ASCII code ( hence '%20' ).

There is a really good discussion of the situation at http://bytes.com/topic/php/answers/5624-urlencode-vs-rawurlencode. It's inconclusive, by the way. RFC 2396 lumps the space with other characters without an unreserved representation, which sides with the '%20' crowd.

RFC 1630 sides with the '+' crowd ( via forum discusion )...

Within the query string, the plus sign is reserved as shorthand notation for a space. Therefore, real plus signs must beencoded. This method was used to make query URIs easier to pass in systems which did not allow spaces.

Also, the core RFCs are...

RFC 1630 - Universal Resource Identifiers in WWW

RFC 1738 - Uniform Resource Locators (URL)

RFC 2396 - Uniform Resource Identifiers (URI): Generic Syntax

Answer 3

As far as i understand it the javascript is corectly URL encoding the string whereas the .net method is not

Actually they're both wrong!

JavaScript escape() should never be used. As well as failing to encode the + character to %2B, it encodes all non-ASCII characters as a non-standard %uNNNN sequence.

Meanwhile Server.UrlEncode is not exactly URL-encoding as such, but encoding to application/x-www-form-urlencoded, which should only normally be used for query parameters. Using + to represent a space outside of a form name=value construct, such as in a path part, is wrong.

This is rather unfortunate. You might want to try doing a string replace of the + character with %20 after encoding with UrlEncode() when you are encoding into a path part rather than a parameter. In a parameter, + and %20 are equally good.