Microsoft KB Archive/181215

= Unable to Pass Query String Which Contains Equal Sign (=) to CGI Program =

Article ID: 181215

Article Last Modified on 6/23/2005

-

APPLIES TO


 * Microsoft Internet Information Server 3.0
 * Microsoft Internet Information Server 4.0

-



This article was previously published under Q181215



We strongly recommend that all users upgrade to Microsoft Internet Information Services (IIS) version 6.0 running on Microsoft Windows Server 2003. IIS 6.0 significantly increases Web infrastructure security. For more information about IIS security-related topics, visit the following Microsoft Web site:

http://www.microsoft.com/technet/security/prodtech/IIS.mspx



SYMPTOMS
When you call a Common Gateway Interface (CGI) program from an HTML form and are using the query string to pass parameters, a blank string is passed to the CGI program. The following example illustrates this behavior.

http:// /cgitest.exe?parameter=value



CAUSE
This is a CGI rule. If an unencoded "=" is in the query string, the command line isn't used for passing parameters; you have to use the query string.

Note that an ISAPI DLL does not encounter this issue.



RESOLUTION
If you are unable to obtain an ISAPI DLL equivalent to the CGI program when you are coding the HTML form, you must ensure that the parameters are separated by the hex substitute for the equal (=) sign. The following example demonstrates this:

http:// /cgitest.exe?parameter%3dvalue



STATUS
Microsoft has confirmed this to be a problem in Microsoft Internet Information Server versions 3.0 and 4.0. We are researching this problem and will post new information here in the Microsoft Knowledge Base as it becomes available.

Additional query words: CGI

Keywords: kbbug kbpending KB181215

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.