Re: CGI-RPG Parameters with different sizes

Joep wrote:
>When you create a link like this, all data after the question mark can be
>retrieved by the calling program as environment variable QUERYSTRING (I
take
>it that that is why you use data structure EnvDta).  The common way to
>identify parameters to the CGI program is to use name-value pairs, e.g.:
>
>Eval      WebOut = '<a href="http://pacnet/cgi-rpg/FD003R4?'
>          + 'location=' + %trim(Location) + '&'
>          + 'mfitem=' + %trim(mfitem) + '&'
>          + 'mordno=' + %trim(mordno) + '">'
>...

Be careful when doing this.  Think about what can happen when the
variables "Location", "mfitem", or "mordno" contain a space,
ampersand, plus sign, or equal sign.  Spaces aren't allowed in
URL's, and are normally replaced by plus signs.  Likewise, plus
signs, equal signs, and ampersands in parameter values must be
replaced by the appropriate hex codes.

On a related topic, you also need to be careful when filling
values into your html documents.  If you're computing a value
(say taken from your database) in your program and writing it to
HTML you also need to properly escape the characters of that
value.  For example, if your value contains characters < > and &,
they need to be replaced by &lt; &gt; and &amp; respectively.

Offhand, I don't know what the OS/400 functions are for properly
encoding parameter values and escaping html text, so check the
documentation.  (I know that Python programmers use the functions
"urllib.quote_plus()" and "cgi.escape()" for these purposes.)

Cheers!  Hans

Hans Boldt, ILE RPG Development, IBM Toronto Lab, boldt@ca.ibm.com