[9304] in www-talk@info.cern.ch
Re: "QUERY_STRING beast" Was "CGI ???"
daemon@ATHENA.MIT.EDU (Darren New)
Fri Nov 17 17:30:31 1995
Date: Fri, 17 Nov 1995 17:27:54 +0000
From: Darren New <dnew@sgf.fv.com>
To: "William F. Hammond" <hammond@csc.albany.edu>
Cc: www-talk@w3.org
In-Reply-To: <199511172207.RAA17552@phoebe.math.albany.edu>
Resent-From: www-talk@w3.org
> Some of the "ugliness" in the CGI standard arises from security
> concerns. Escaped characters exist in part to prevent processes on
> various systems from choking on characters that are special to those
> processes, and, therefore, to make CGI robust across many platforms.
Actually, I thought CGI stuff was escaped because it's basically
URL-like, and URLs are escaped so they are easy to read/print/etc.
Nothing to do with security.
> The QUERY_STRING may be empty and certainly does not need to be
> a "beast" if client data is dispatched with method POST -- the
> *recommended* way.
Well, you could certainly make the server decode the URL escapes instead
of the CGI script, but that doesn't mean having the CGI script do it is
somehow wrong.
