26

Is there any formal restriction as to which characters are allowed in URL parameter names?

I've been reading RFC3986 ("Uniform Resource Identifier (URI): Generic Syntax") but came to no definitive conclusion.

I know there are practical limitations, but would it actually be forbidden to do something like:

param with\funny<chars>=some_value

as long as I escape it correctly:

param%20with%1cfunny%3cchars%3e=some_value
Community
  • 1
  • 1
Tomalak
  • 332,285
  • 67
  • 532
  • 628

4 Answers4

13

There are no restrictions on escaped parameter names in the URI specs. There might be restrictions in the server-side software that you use, though. This is especially true if you use “homemade” scripts to interpret URIs.

Konrad Rudolph
  • 530,221
  • 131
  • 937
  • 1,214
  • That's exactly why I've been asking... http://stackoverflow.com/questions/814613/how-to-read-data-from-url-using-javascript -- I guess my answer would need an overhaul to make it correct in unusual situations. – Tomalak May 02 '09 at 11:41
  • Ah, that complicates the situation substantially. Especially since using `&` as delimiter is only a convention; other ones could be used instead, e.g. `,` and `;` used to be used quite a lot. Also, many server engines (PHP, Rails, …) support nested arguments, so this would be a legal URI with query: http://example.com/?a=b;c[1]=x;c[2]=y … A lot of web applications actually use this query notation for form data (options, checkboxes …) to get array-like data. – Konrad Rudolph May 02 '09 at 11:51
  • So I guess it boils down to "there is no single correct function to pull parameters out of an URL" -- unless you are prepared to accept that "c[1]=x" is a server-side convention, and the parameter you are looking for is *in fact* called "c[1]" on the client (which would be factually correct, but come as strange to those accustomed to server side programming...). – Tomalak May 02 '09 at 11:55
  • Please allow a question on this. It is October 2017 and I use Bluehost (Apache). I am trying to pass in an actual partial filename. The file is called `2017-10-15.jpg` and I want it to display when I use `showplot.htm?dt=2017-10-15` with the Javascript line `document.write('')` - and it isn't working. It displays everything except lines where I try to concatenate like this. Is it because it can't handle the hyphens? – SDsolar Oct 17 '17 at 22:18
8

You should also read RFC2396. It seems to be more informative than RFC3986.

m_vitaly
  • 11,856
  • 5
  • 47
  • 63
  • 4
    Section 3.4. ("Query Component") has it: "The query component is a string of information to be interpreted by the resource.". This would basically mean "anything goes", just as I thought. – Tomalak May 02 '09 at 12:36
  • It's just not HTTP specific, unfortunately. But I guess there is no standard here, just convention. – Tomalak May 02 '09 at 12:38
2

Per RFC 2396, the parameter names and values can contain upper/lower case letters, decimal digits, and -_.!~*'() characters. Everything else needs to be escaped.

inder
  • 1,774
  • 1
  • 15
  • 15
  • 1
    RFC 2396 was obsoleted by RFC 3986 (see [here](https://lists.oasis-open.org/archives/xacml/200910/msg00034.html) and specifically in RFC 3986 under [appendix D.2](https://tools.ietf.org/html/rfc3986#appendix-D.2)), so that [a query string can legally include the following *unencoded* characters](https://stackoverflow.com/a/31300627/3002584): `/ ? : @ - . _ ~ ! $ & ' ( ) * + , ; =` – OfirD Mar 04 '21 at 22:17
2

There are reserved characters for URLs, but as long as you escape (urlencode) then you should be fine.

Depending on the framework used, you may get exceptions if you try to submit suspicious values. ASP.NET has content filtering that will throw exceptions if you try to submit "unsafe" data, like scripts or HTML. That's a feature of the framework though rather than a limitation or rule enforced by the URL syntax.

Neil Barnwell
  • 41,080
  • 29
  • 148
  • 220