0

I have a problem which is due to to IIS turning off + as spaces in querystrings.

We have clients posting some data to a hidden page as a querystring (jobs) and they sometimes post jobs with things like C++ in them etc - as they are passing the data we cannot expect them to encode it properly %2B as they are mostly non techie and sometimes they mix n match which is fun.

We also have places where we have querystrings within querystrings (sometimes up to 4 when passing filenames into a flash file for the click link, then the redirect url onclick that goes to a page that logs the click then the final url to go to show the customer!).

There are also other places where we have URLs in URLS such as redirect on login and so on.

Plus signs shouldn't really be a problem but we have found a few issues where they are so I just want one function that can sort it out.

For times when we have needed to encode ASP URLS (due to their being no Server.URLDecode function) even though we mostly don't need to as the page un-encodes them, we use a server side JavaScript ASP Classic (I know!) function e.g

<script language="JavaScript" RUNAT="SERVER">
function URLDecode(strIN) 
{           
    // JS will return undefined for vars that have not been set yet whereas VB doesn't so handle
    if(strIN){              
        var strOUT = decodeURIComponent(strIN);         
        return strOUT;    
    }else{ //for undefined or nulls or empty strings just return an empty string
        return "";
    }       
}
</script>

However I am trying to get round any possible problems with + signs with a simple hack where I replace it first with a placeholder then replace it back after decoding e.g

<script language="JavaScript" RUNAT="SERVER">
function URLDecode(strIN) 
{           
    // JS will return undefined for vars that have not been set yet whereas VB doesn't so handle
    if(strIN){  
        strIN = strIN.replace("+","##PLUS##");
        var strOUT = decodeURIComponent(strIN);
        strOUT = strOUT.replace("##PLUS##","+") 
        return strOUT;    
    }else{ //for undefined or nulls or empty strings just return an empty string
        return "";
    }       
}
</script>

However on running this I am getting the following error

Microsoft JScript runtime error '800a01b6'

Object doesn't support this property or method

/jobboard/scripts/VBS/EncodeFuncLib.asp, line 781 

this line is

strIN = strIN.replace("+","##PLUS##");

I've tried

strIN = strIN.replace(/\+/g,"##PLUS##");
strIN = strIN.replace('/\+/','##PLUS##');

But nothing seems to work.

Running this code as client side JavaScript works fine so I don't know why it's not running server side.

I don't want to have to search 300+ files for places where this function is called server side and do the placeholder/replace around the URLDecode function so I would like to know what the problems is and how to solve it.is.

At first I thought it was because we had moved to Windows 2012 and IIS 8 and they had a new JS.dll that needed to be install (from reading up on it) - however we still have some 2003 servers on IIS 7 and I am getting the same problem there as well.

Unless my server guy isn't telling me something like the version of IIS we are using on 2003 I don't know what is going on.

Can anybody shed some light on this.

Am I being a numpty?

What could be the issue?

Thanks in advance for any help.

CLaFarge
  • 1,277
  • 11
  • 16
MonkeyMagix
  • 677
  • 2
  • 10
  • 30
  • 1
    Try checking the value of `typeof strIn` just before your statement. It sounds like it may not be `string`. – Bond Jul 17 '15 at 13:29

1 Answers1

0

The regex to replace plus signs is strIN = strIN.replace(/\+/g,"##PLUS##"); Because + has a meaning in regex, it needs to be escaped with a backslash.

Matthew
  • 4,149
  • 2
  • 26
  • 53
  • I actually put strIN = strIN.replace('/\+/','##PLUS##'); into the post but it must have stripped out the \ before the + for some reason. Anyway I just tried it again and it still doesn't work PLUS there is no reason strIN = strIN.replace("+","##PLUS##"); shouldn't work anyway. Thanks – MonkeyMagix Jul 17 '15 at 13:15