specifying anchors and cgi parameters in a single URI

[Crimperman]

Hi,

need some advice on URIs

In a dynamic page (perl driven) we list a number of items presented in
an hierarchical tree structure. Within that page is a form which allows
you to search for items containing various strings (trying to get the
users to *remember* CTRL+F was proving fruitless). The results are then
presented at the top of the page with links to the relative anchor
references (<a href="#foo">) . When clicked these would take you to
that item in the hierarchical tree.

The problem is that the URI of the page itself contains CGI parameters
( e.g. http://www.foo.com/script.cgi?p=1&r=2 ) and these are carried
over to the URIs containing the anchors ( e.g.
http://www.foo.com/script.cgi?p=1&r=2#foo ).

These URIs containing parameters and anchors work in IE (6 and below)
but not in Moziall,Firefox , Konqueror or Opera. Any ideas on what I can
do to enable the same functionality cross-browser?

regards
Crimperman

[mbstevens]

Crimperman wrote:

Hi,

need some advice on URIs

In a dynamic page (perl driven) we list a number of items presented in
an hierarchical tree structure. Within that page is a form which allows
you to search for items containing various strings (trying to get the
users to *remember* CTRL+F was proving fruitless). The results are then
presented at the top of the page with links to the relative anchor
references (<a href="#foo">) . When clicked these would take you to
that item in the hierarchical tree.

The problem is that the URI of the page itself contains CGI parameters
( e.g. http://www.foo.com/script.cgi?p=1&r=2 ) and these are carried
over to the URIs containing the anchors ( e.g.
http://www.foo.com/script.cgi?p=1&r=2#foo ).

These URIs containing parameters and anchors work in IE (6 and below)
but not in Moziall,Firefox , Konqueror or Opera. Any ideas on what I can
do to enable the same functionality cross-browser?

regards
Crimperman

A number of URI characters must be encoded, one of which is "#".
Use "%23" for it. Google "URI encoding" for more detail.

If you don't know about this already,
you _may_ also have written your script in a way that
crackers can get into easily.

Google for "Perl detainting" and "Perl CGI security" and such.
Be sure to use cgi.pm instead of your own cgi interface -- it
has many security checks built in that you may not have thought
about.
--
mbstevens
http://www.mbstevens.com/

[Crimperman]

mbstevens wrote:

A number of URI characters must be encoded, one of which is "#".
Use "%23" for it. Google "URI encoding" for more detail.
This creates two problems. An href of "%23foo" (and *only* that) is not
passed by the browser as a local anchor - it is instead passed as
http://www.foo.com/#foo .
Giving the entire URI in the link to the anchor (
http://www.foo.com/script.cgi?p=1&r=2%23foo ) ends up with the browser
passing 2%23foo as the value for the last parameter.
Encoding the # using # just gives the same result as using a plain
# character.
If you don't know about this already,
you _may_ also have written your script in a way that
crackers can get into easily.

I did know about it (the other relevant characters are encoded) but -
in this case - the script is not on a public facing site and I don't
use this kind of script on any of the public facing ones. Thanks tho'.

Crimperman

[David Dorward]

Crimperman wrote:

The problem is that the URI of the page itself contains CGI parameters
( e.g. http://www.foo.com/script.cgi?p=1&r=2 ) and these are carried
over to the URIs containing the anchors ( e.g.
http://www.foo.com/script.cgi?p=1&r=2#foo ).

These URIs containing parameters and anchors work in IE (6 and below)
but not in Moziall,Firefox , Konqueror or Opera. Any ideas on what I can
do to enable the same functionality cross-browser?

They should just work everywhere. What does your link target look like? <a
name="#foo">... </a> is a common mistake (there shouldn't be a # character
in the name).

--
David Dorward <http://blog.dorward.me .uk/> <http://dorward.me.uk/>
Home is where the ~/.bashrc is

[David Dorward]

mbstevens wrote:

A number of URI characters must be encoded, one of which is "#".
Use "%23" for it. Google "URI encoding" for more detail.

That is because the # character has special meaning in URLs, so if you want
to pass that character to the server you have to encode it. In this case
the OP *wants* the special meaning, so URL Encoding it would not be the way
to go.

--
David Dorward <http://blog.dorward.me .uk/> <http://dorward.me.uk/>
Home is where the ~/.bashrc is

[Crimperman]

Solved.

It turned out the targets were all coded incorrectly. They were all of
the form <a name="#foo"></a> . That is including the hash mark in the
name of the target!

Many thanks for the suggestions though.

Crimperman

[mbstevens]

David Dorward wrote:

mbstevens wrote:

A number of URI characters must be encoded, one of which is "#".
Use "%23" for it. Google "URI encoding" for more detail.

That is because the # character has special meaning in URLs, so if you want
to pass that character to the server you have to encode it. In this case
the OP *wants* the special meaning, so URL Encoding it would not be the way
to go.

You're usually spot on, so I may be misunderstandin g your intention
here, but:

the CGI.pm module handles encoding and decoding transparently.
My reference claims that all data attached to the URI and sent
by the GET method should be encoded.

I'm thinking that perhaps some of his browsers are taking
care of the encoding for him, and some aren't.

At any rate, if the OP is not using CGI.pm, a simple
regex over the would fix him up, no?
--
mbstevens
http://www.mbstevens.com/

[David Dorward]

mbstevens wrote:

That is because the # character has special meaning in URLs

the CGI.pm module handles encoding and decoding transparently.

The = character also has special meaning, so I'll use it in this example:

http://www.example.com/foo?this=that%3Dsomething

When the query string gets parsed the "=" character will be treated as a
special character while the "%3D" will be decoded to an "=" - but this
latter one is not a special character (it was URL encoded) so it is treated
as data.

Thus:

#!/usr/bin/perl
use CGI;
my $q = CGI->new();
print $q->header;
print $q->param('this' );

Will output:

that=something

It is for similar reasons that if you URL encode the "#" character (in the
example with the query string) then it will get treated as just another bit
of data on the query string, and not as the special character the delimits
the URL from the fragment identifier.

--
David Dorward <http://blog.dorward.me .uk/> <http://dorward.me.uk/>
Home is where the ~/.bashrc is

[Harlan Messinger]

mbstevens wrote:

A number of URI characters must be encoded, one of which is "#".
Use "%23" for it. Google "URI encoding" for more detail.

If you don't know about this already,
you _may_ also have written your script in a way that
crackers can get into easily.

Google for "Perl detainting" and "Perl CGI security" and such.

Google returns nothing for "perl detainting", and Perl CGI security is
too broad considering you haven't given any details as to the nature of
the breach. Can you give us something more specific?

[Harlan Messinger]

David Dorward wrote:

Crimperman wrote:

The problem is that the URI of the page itself contains CGI parameters
( e.g. http://www.foo.com/script.cgi?p=1&r=2 ) and these are carried
over to the URIs containing the anchors ( e.g.
http://www.foo.com/script.cgi?p=1&r=2#foo ).

These URIs containing parameters and anchors work in IE (6 and below)
but not in Moziall,Firefox , Konqueror or Opera. Any ideas on what I can
do to enable the same functionality cross-browser?

They should just work everywhere. What does your link target look like? <a
name="#foo">... </a> is a common mistake (there shouldn't be a # character
in the name).

AND it works in IE, so that would be consistent with the OP's observation.