26

Is there any formal restriction as to which characters are allowed in URL parameter names?

I've been reading RFC3986 ("Uniform Resource Identifier (URI): Generic Syntax") but came to no definitive conclusion.

I know there are practical limitations, but would it actually be forbidden to do something like:

param with\funny<chars>=some_value

as long as I escape it correctly:

param%20with%1cfunny%3cchars%3e=some_value
Improve this question

4 Answers 4

Reset to default
13

There are no restrictions on escaped parameter names in the URI specs. There might be restrictions in the server-side software that you use, though. This is especially true if you use “homemade” scripts to interpret URIs.

Improve this answer
Sign up to request clarification or add additional context in comments.

4 Comments

That's exactly why I've been asking... stackoverflow.com/questions/814613/… -- I guess my answer would need an overhaul to make it correct in unusual situations.
Ah, that complicates the situation substantially. Especially since using & as delimiter is only a convention; other ones could be used instead, e.g. , and ; used to be used quite a lot. Also, many server engines (PHP, Rails, …) support nested arguments, so this would be a legal URI with query: example.com/?a=b;c[1]=x;c[2]=y … A lot of web applications actually use this query notation for form data (options, checkboxes …) to get array-like data.
So I guess it boils down to "there is no single correct function to pull parameters out of an URL" -- unless you are prepared to accept that "c[1]=x" is a server-side convention, and the parameter you are looking for is in fact called "c[1]" on the client (which would be factually correct, but come as strange to those accustomed to server side programming...).
Please allow a question on this. It is October 2017 and I use Bluehost (Apache). I am trying to pass in an actual partial filename. The file is called 2017-10-15.jpg and I want it to display when I use showplot.htm?dt=2017-10-15 with the Javascript line document.write('<img src="' + dt + '.jpg"/>') - and it isn't working. It displays everything except lines where I try to concatenate like this. Is it because it can't handle the hyphens?
8

You should also read RFC2396. It seems to be more informative than RFC3986.

Improve this answer

2 Comments

Section 3.4. ("Query Component") has it: "The query component is a string of information to be interpreted by the resource.". This would basically mean "anything goes", just as I thought.
It's just not HTTP specific, unfortunately. But I guess there is no standard here, just convention.
2

There are reserved characters for URLs, but as long as you escape (urlencode) then you should be fine.

Depending on the framework used, you may get exceptions if you try to submit suspicious values. ASP.NET has content filtering that will throw exceptions if you try to submit "unsafe" data, like scripts or HTML. That's a feature of the framework though rather than a limitation or rule enforced by the URL syntax.

Improve this answer

Comments

2

Per RFC 2396, the parameter names and values can contain upper/lower case letters, decimal digits, and -_.!~*'() characters. Everything else needs to be escaped.

Improve this answer

1 Comment

RFC 2396 was obsoleted by RFC 3986 (see here and specifically in RFC 3986 under appendix D.2), so that a query string can legally include the following unencoded characters: / ? : @ - . _ ~ ! $ & ' ( ) * + , ; =

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.