when assigning location.href, please explain url encoding (in asp.net and firefox)

Question

In some javascript, I have:

var url = "find.aspx?" + "location=" + encodeURIComponent( address );
alert( url );
location.href = url;

where the value of address is the string "Seattle, WA".

In the alert I see

find.aspx?Seattle%2C%20WA

as I expect.

But on the server side, when I look at Request.Url, the relevant substring I see is

find.aspx?Seattle, WA

And in the Firefox url window I see

find.aspx?location=Seattle%2C WA

So I'm getting three different representations whereas I would expect that in all three places I should see what I see in the alert. My expectation is that the url I assign to location.href should show up as-is in the browser url window, and should be passed as-is to the server in Request.Url (and I would need to decode the values on the server before using them). What's happening?

Answer 1

Firefox converts certain encoded characters into their literal forms as a way to be friendly to users. It will also convert spaces typed into the address bar into %20 for the server.

Update: The reason Firefox doesn't display the comma unencoded is because commas are allowed in URLs, but spaces are not, so it knows that a space is going to be unambiguously interpreted, whereas the pre-encoded comma is different from a non-encoded comma to some servers. see: http://stackoverflow.com/questions/198606/can-i-use-commas-in-a-url

ASP is probably trying to help you out by auto-un-encoding the string for you.

Update: It looks like ASP.NET unencodes Request.Url for you by default, as mentioned here: http://stackoverflow.com/questions/123994/querystring-malformed-after-urldecode They also mention that you can use HttpRequest.Url.Query to access the un-decoded version.

The alert is the only thing not doing any "magic" for you.

Answer 2

For your example you can change this line

var url = "find.aspx?" + "location=" + encodeURIComponent( address );

to

var url = "find.aspx?" + "location=" + address;

and see the address as it is. Bu if address variable contains any '&' character your variable will be corrupt. So you are using encodeURIComponent to encode these things url.

On the Server side all these encoded strings are decoded back. It means encodeURIComponent is just for sending the address variable (whether it contains & character or not) to server side correctly.