3

In our code we have query string variables with very short names such as cId, iId, isA and u. It is very hard to tell what this variables are from their names. I want to use more descriptive names such as customerId, itemId, isAnonymous and user.

I want to know the disadvantages of using long names in query strings if there are any.

Thanks

CleanCoder
  • 807
  • 1
  • 9
  • 19
  • 4
    Not related to variable name length, but what happens if users change the variable values to those of other customers or items? Do they get to see other customer's data? That is a serious security lapse you should address. – Dour High Arch Apr 26 '11 at 22:16

3 Answers3

3

Another argument I've heard for short variable names in the query string is to somewhat obfuscate the variables to try to prevent your users from "getting creative" and trying to access stuff they shouldn't by editing the URL. I'm not sure I agree with this unless you're doing something crazy like setting IsAdminUser=false somewhere in the URL - but if you're doing that you may have deeper issues with your code. ;)

ZombieSheep
  • 29,603
  • 12
  • 67
  • 114
  • 2
    Security through obscurity is never a good thing. And I think we'd all agree that the querystring feels dirty. :) – John Batdorf Apr 26 '11 at 22:18
  • Absolutely. I did say I wasn't convinced by the argument, but I was putting it out there for the OP to make his own mind up about it. :) – ZombieSheep Apr 26 '11 at 22:22
2

I would keep variable names short, as the limit tends to be about 2,047 characters, but other browsers can handle more. There's a good explanation here: http://www.asp101.com/tips/index.asp?id=102

Just because Nija sees 4,000 in one of his, is definitely not a good idea to assume that will work for you.

John Batdorf
  • 2,502
  • 8
  • 35
  • 43
0

You have a limit of 255 characters for GET operations, so you really need to be sparing in your names there. For POST operations, there's no need to worry about verbosity.

Mike Thomsen
  • 36,828
  • 10
  • 60
  • 83
  • I have analytics data that comes at almost 4000 characters (encoded). It's a bug (in my data sending), but it's still ~4K in a GET request. – QuinnG Apr 26 '11 at 21:18