ansaurus

Question

Answer 1

+3 A:

The "problem" is due to URL-encoding. You'll need to URL-decode the value you get from QUERY_STRING.

LarsH 2010-10-12 22:35:06

Like @nategoose said, the "damage" was done by the browser before your server ever received it. (Check the access logs and you'll see.)

LarsH 2010-10-12 22:42:45

Answer 2

+1 A:

The %3A type stuff is the HTTP hexadecimal encoding of characters which may be special. It is just like escaping the quote character in a C string. "\""

The PATH environmental variable has nothing to do with HTTP, so it is not effected. Your web server program is setting the QUERY_STRING to what the web browser sent, which has the % hex encoding in it.

nategoose 2010-10-12 22:36:38

Answer 3

+2 A:

  char *data = malloc(200);
  data=getenv("QUERY_STRING");

Memory leak here. You're allocating 200 bytes you'll never use or be able to free(). (Or not, for malloc() may fail and return NULL.)

  char m[200];
  sscanf(data,"%s", m);

This is a crude replacement for strcpy()/strncpy(). Results in a buffer overflow if the query string is more than 200 characters long. Also terminates as soon as it finds a whitespace, but that's not a problem becuase they've been turned to + or %20 during URL encoding.

  ptr=fopen("c:/test.txt", "w");
  fprintf(ptr, "%s", m);

fopen() may fail, resulting in a return value of NULL.

I suggest you review pointers and memory allocation, look up some string manipulation functions other than printf/scanf and also make a habit of checking for errors, i.e. coding defensively. Even in small, example-quality code.

aib 2010-10-12 23:16:18

ansaurus

tags:

views:

answers:

getenv(QUERY_STRING) in C CGI

related questions