Browser removing + from request parameter

Question

Hello everyone,

I'm trying to pass an SQL query string from a Java Applet to Servlet as a parameter.

Problem is that in Applet I have something say: sql=select * from p where(+p=1)

The resulting sql parameter in the Servlet is sql=select * from p where(+p=1).

So anyone knows how to prevent the browser from removing the + character from parameters?

Is there a escape character?

Thank you.

Answer 1

Do not EVER do this. This is the direct way for the SQL injection (for example any user can insert the DELETE request to the get string and crash your server)

Answer 2

You can use java.net.URLEncoder for this.

param = URLEncoder.encode(param, "UTF-8");

---

That said, the whole idea is leaky and very prone to attacks. One could easily reveal the URL and manually send a DELETE FROM p to it. Rather send commands as parameters, not complete SQL queries. Keep and hide the SQL queries in the server side.