Re: LYNX-DEV Lynx - problem with cuadra pages

[Foteos Macrides]

Klaus Weide <address@hidden> wrote:
>[...]
>That is, spaces in the NAME attribute values of form fields should be
>encoded as '+' and not as '%20'.  It seems Cuadra is right here and Lynx
>is wrong, since at least RFC 1866 (the HTML 2.0 spec) says:
>
>8.2.1. The form-urlencoded Media Type
> ....
>        1. The form field names and values are escaped: space
>        characters are replaced by `+', and then reserved characters
>        are escaped as per [URL]; that is, non-alphanumeric
>        characters are replaced by `%HH', a percent sign and two
>        hexadecimal digits representing the ASCII code of the
>        character. [...]
>
>That is, "space characters are replaced by `+'" seems to apply to values
>_and names_, not just to values (as implemented in recent Lynx versions).
>
>This will be corrected in the development code (it is a trivial change,
>replacing a few calls to HTEscape() in one file GridText.c with calls to
>HTEscapeSP()), unless someone gives a good reason for not doing so.
>Brief testing shows that with this change Lynx can communicate with the
>cuadra pages.
>
>Making the change now in the Lynx code will of course not help all those
>Lynx users, unless they upgrade to the latest development code.  Since
>you are already in contact with the Cuadra programmer, you should suggest
>that they make the parsing of form submissions more robust by
>always decoding a '%20' the same way as a '+'.  As far as I can see this
>would not introduce any ambiguity, and is already done for form _values_.

        I had debated about that when I added the HTEscapeSP() function
to libwwwFM, and thought back then that it might be better to hold off
for the name fields, but decided last night that it's time to do it for
them too.  All scripts should hex unescape the entire content, but
apparently some don't, so it's a catch-22.  Here's my entry for the
FOTEMODS (not yet zipped at slcc):

* Mods in GridText.c to use HTEscapeSP() for space-to-plus conversions of
  name fields, and not just value fields, in submitted form content.  Note
  that some CGI scripts may still be doing plus-to-space restorations only
  for value fields, and only hex unescaping for name fields, while others
  may not be hex unescaping the name fields, so we may as well follow the
  specs fully (and cross our fingers :). - FM


                                Fote

=========================================================================
 Foteos Macrides            Worcester Foundation for Biomedical Research
 address@hidden         222 Maple Avenue, Shrewsbury, MA 01545
=========================================================================
;
; To UNSUBSCRIBE:  Send a mail message to address@hidden
;                  with "unsubscribe lynx-dev" (without the
;                  quotation marks) on a line by itself.
;