Request Parameter Losing Plus Sign

Question

I am editing a search form and trying to protect against special characters in the database. In the JSP search form, a (multiselect) dropdown allows users to select descriptions that will be used in the query (note: descriptions is a list of strings):

<select id="descriptionSelect" multiple="multiple">

    <c:forEach items="${descriptions}" var="description">

        <option value="${fn:escapeXml(description)}")}">                            

            <c:out value="${description}" />

        </option>

    </c:forEach>

</select>

When the form submits, the page dynamically generates the URL which takes query parameters in the URL (ugly, I know, hands are tied). Here's the snipet making the description segment.

var descriptionSelectBox = document.getElementById("descriptionSelect");

var descriptionsUrlAddition = "";



for (var i = 0; i < descriptionSelectBox.options.length; i++) {

    if (descriptionSelectBox.options[i].selected) {

        descriptionsUrlAddition += "&descriptions=" + escape(descriptionSelectBox.options[i].value);

    }

}

I have a test entry in the database whose description is:

AAA `[email protected]#$%^&*()_+-={}|[]\:";'<>?,./ And wow this has a lot of special characters.

With the code above, for some reason when the request gets to the controller, the description loses the + sign (it becomes just a space).

Does anyone know what might be happening and how to fix it? I am not sure if it's something to do with URLs special use of +, or what. I could edit how the descriptions list is populated (maybe escaping there). If you offer this as a suggestion, please use Java specific code (no Apache escape utils classes, etc).

If it helps, using alerts in the JavaScript indicate that the + sign is not being transformed before sending the request.

Recommended for you: Get network issues from WhatsUp Gold. Not end users.

Answer 1

+ means "space" in URLs. Replace it with %2B. You could do this just after composing descriptionsUrlAddition, for example.

descriptionsUrlAddition = descriptionsUrlAddition.replace('+', '%2B');

Request Parameter Losing Plus Sign

Sign up