Can I use commas in a URL?

Question

I typically use URL rewriting to pass content IDs to my website, so this

 Foo.1.aspx 

rewrites to

 Foo.aspx?id=1

For a specific application I need to pass in multiple IDs to a single page, so I've rewritten things to accept this:

 Foo.1,2,3,4,5.aspx

This works fine in Cassini (the built-in ad hoc web server for Visual Studio) but gives me "Internet Explorer cannot display the webpage" when I try it on a live server running IIS. Is this an IIS limitation? Should I just use dashes or underscores instead of commas?

Solution 1

I recall that Url Routing by default first checks to see if the file exists, and commas are not legal in filenames, which is parhaps why you are getting errors. IIS may have legacy code that aborts the request before it can get to asp.net for processing.

Scott Hanselman's blog post talks a bit about this and may be relevant for you.

---

As general comment: Url rewriting is typically used to make a url friendly and easy to remember.

~/page.aspx?id=1,2,3,4 is neither worse nor better than ~/page/1-2-3-4.aspx : both are difficult to use so why go through the extra effort? Avoid creating new url forms just because you can. Users, help desk, and other developers will just be confused.

Url rewriting is best utilized to transform

~/products/view.aspx?id=1
~/products/category.aspx?type=beverage

into

~/products/view/1
~/products/category/beverage

Solution 2

Commas are allowed in the filename part of a URL, but are reserved characters in the domain*, as far as I know.

What version of IE are you using? I've come across the odd report of IE5.5 truncating URLs on a comma (link here, but have tested URLs with commas in IE7 and it seems to be OK, so if there was an IE bug, it doesn't seem to be there any more - could it be an IIS issue?

I'm wondering if the page error is due to a rule failure with the mod_rewrite - can you post the rule which is matching multiple ids and passing them off to your Foo.aspx? Is there any chance that it's only matching Foo.N,N, and failing on more commas?

---

URI RFC

2.2. Reserved Characters

Many URI include components consisting of or delimited by, certain special characters. These characters are called "reserved", since their usage within the URI component is limited to their reserved purpose. If the data for a URI component would conflict with the reserved purpose, then the conflicting data must be escaped before forming the URI.

 reserved    = ";" | "/" | "?" | ":" | "@" | "&" | "=" | "+" |
                "$" | ","

The "reserved" syntax class above refers to those characters that are allowed within a URI, but which may not be allowed within a particular component of the generic URI syntax

Solution 3

Try using %2c in the URL to replace the commas.

Solution 4

In addition to the answer by ConroyP, below is another citation to the RFC. It notes a number of unsafe characters, but does not mention the comma (suggesting that the comma is safe):

Characters can be unsafe for a number of reasons. The space character is unsafe because significant spaces may disappear and insignificant spaces may be introduced when URLs are transcribed or typeset or subjected to the treatment of word-processing programs. The characters "<" and ">" are unsafe because they are used as the delimiters around URLs in free text; the quote mark (""") is used to delimit URLs in some systems. The character "#" is unsafe and should always be encoded because it is used in World Wide Web and in other systems to delimit a URL from a fragment/anchor identifier that might follow it. The character "%" is unsafe because it is used for encodings of other characters. Other characters are unsafe because gateways and other transport agents are known to sometimes modify such characters. These characters are "{", "}", "|", "\", "^", "~", "[", "]", and "`".

All unsafe characters must always be encoded within a URL. For example, the character "#" must be encoded within URLs even in systems that do not normally deal with fragment or anchor identifiers, so that if the URL is copied into another system that does use them, it will not be necessary to change the URL encoding.

Solution 5

The comma is allowed in the path, query string and fragment according to spec. It wouldn't surprise me if IE doesn't conform to the spec though. Try the entity as Claudiu suggests, but I don't know why that would be necessary.

View more solutions

Comments

[JacquesB]

Try with another browser, that will show if it is a IE specific problem or a IIS problem.

[Herb Caudill]

Didn't work with Firefox either. I'm guessing it was an IIS thing.

[Jay]

trulia.com/for_sale/Las_Vegas,NV/2p_beds this is one of the biggest websites and uses comma to separate filters

[Herb Caudill]

Yeah, you've got a point about URL rewriting not adding a lot of value here - but this is a pattern we use throughout the site and it's just a matter of consistency more than anything else.

[Joel Coehoorn]

It's helps, because that's what he should be re-writing to: it's the result. And it is the right way to pass multiple values/array-ish values through the query string. Yeah, it's not what he asked, but it is relevant to the question.

[Nas Banov]

horrible idea - how is ";" as separator any better than ","? the url you refer to gives bad reasoning

[Joel Coehoorn]

@Nas - ; by itself is not any "better", but you missed that it's not just ;. You also repeat the name of the parameter each time. This is the method suggested by the http spec and it is better supported by asp.net (an array with the items is created automatically)

[Nas Banov]

@Joel Coehoorn: perhaps you meant Foo.aspx?id=1&id=2&id=3&id=4&id=5 then, the way multiple parameters are passed in http query?

[Joel Coehoorn]

@Nas - exactly - that's what the example in my answer looks like and I mentioned that this only the target - what you get after the re-write, not what the user sees

[Chris Johnson]

The original question doesn't entirely match the title ... for those like me interested in the general question of which characters are allowed in URLs, the key facts are (a) the rules are different for different components of the URL, as @eyelidlessness pointed out; and (b) the full spec including BNF grammar can be found at ietf.org/rfc/rfc2396.txt

[Boris Verkhovskiy]

"commas are not legal in filenames" On which file systems? I think on Linux the only thing a file name can't contain is a slash / or a line terminator \0.

[Ashwin]

@Boris this very old answer is discussing full framework early versions of asp.net when it only ran on windows os and you had to hand-roll these kinds of routing techniques. Routing in ASP.NET Core is probably more appropriate these days.