UrlEncoding-Safe Delimiter

Question

So the site I'm working on has a filter system that operates by passing a key and value system through a querystring.

The whole site is going through a re-factor soon and I'm maintaining the existing site so before we discuss the RIGHT way to implement this, I just need ideas for changing my delimiter.

The current format is like this:

cf=<key>:<value>

The problem is, I've recently run into an issue because some of our new values for this filter contain : in them. I.e: cf=MO_AspectRatio:16:10

The value is being UrlEncoded, but the browsers are de-coding %3a into : on the fly because the : doesn't inherently break the urls.

I need some suggestions for url-safe delimiters that aren't :,-,_,&,? that makes sense. I'm not looking for a solution like () or something wild.

Answer 1

What about pipe?

cf=MO_AspectRatio|16:10

Answer 2

The most straight forward solution is to base64 encode the entire string, and then base64 decode it on input.

Another option is to urlencode it twice before output, and then urldecode it once on input (There will be an automatic urldecode done on all input by php or maybe apache not sure who does this).

Answer 3

This Wikipedia article is useful to learn more about unreserved and reserved characters.

As far the tilde ~ is probably the best option. But the chances are still there that it will break sooner or later. Or you should document and validate that properly on user input.

Answer 4

The URI scheme generic syntax admits two valid parameter separators: & and ;. I've allways seen the former, and never the later. The ? symbol is needed to correctly identify the start of the query string, so I would not recommend using it. Same goes for the /, used on urls.

Any character that isn't one of those and isn't part of your values is acceptable. Here's a list of possible ones, sorted by my own preference, not including the ones you explicitly rejected:

, + | # $ !

Any of them should do.

Also, even if you specifically asked not to: In the future refactor, try to use real URI paramters (using &). Will save you lots of headhaches.