[Templates] The uri filter and fragments

[Randal L. Schwartz]

>>>>> "C" == C Chad Wallace <cwallace@lodgingcompany.com> writes:

C> I'm pretty sure you're not supposed to URI encode links in HTML at all.  That's the browser's job.  When you click on a
C> link that contains '%20', the browser should escape the % sign, making it '%2E20', when it sends the request to the
C> server.  That's not at all what you want.  So just do [% u | html %].

C> Basically:

C> URI encoding is for HTTP, from the browser to the web server.

Uh, no.  It's for both directions.

If I want my web server to find the resource named "Randal's File.txt",
I cannot include:

        <a href="Randal's File.txt">Get my file!</a>

as an anchor.  I need to URI encode the filename:

        <a href="Randal%27s%20File.txt">Get my file!</a>

The browser returns that link as-is (minus HTML entities, see below),
requesting something like "GET /some/place/Randal%27s%20File.txt HTTP/1.0" in
the request.  The web server "de URIs" it, and gets the real name with the
spaces.

C> HTML encoding is for HTML, from the web server to the browser.

Yes, and that also includes attributes.  If I wanted to run "Randal's
File.cgi", passing it both fred=flintstone and barney=rubble as
parameters, using an ampersand for a delimiter, I'd construct the URI as:

   Randal%27s%20File.txt?fred=flintstone&barney=rubble

and *then* I'd have to HTML-entitize that (& becomes &amp;):

  <a href="Randal%27s%20File.txt?fred=flintstone&amp;barney=rubble">gimme!</a>

For this, the browser will request back to the server:

 GET /some/place/Randal%27s%20File.cgi?fred=flintstone&barney=rubble HTTP/1.0

because the protocol is URI-encoded, but not HTML encoded.

This is why the advice is as it is in the docs.  Filenames have to be URI
encoded if part of a URI, and *everything* has to be HTML-ized.

-- 
Randal L. Schwartz - Stonehenge Consulting Services, Inc. - +1 503 777 0095
<merlyn@stonehenge.com> <URL:http://www.stonehenge.com/merlyn/>
Perl/Unix/security consulting, Technical writing, Comedy, etc. etc.
See PerlTraining.Stonehenge.com for onsite and open-enrollment Perl training!