Querystring capturing shenanigans

[Rusty Chainsaw]

Hello people...
N00b here with a little ASP question you might all be able to help me with...
I've been writing an ASP script to go at the top of each page of the site to capture querystrings, strip out all unnecessary variables, then redirect using only the valuable variables (if they exist) with a 301 and Response.AddHeader (this is all to make the site more streamlined for Google searches and rankings).

Now, I've hit a problem... if I use a link with variables that doesn't point at a particular page, eg:

http://mysite.com/?AF=3223&shoid=31ORJQR6YS

.. then theoretically default.asp (which has my code in it) should be the destination, and the code in the page should filter out the crap in the URL. And it does, if the url is:

http://mysite.com/default.asp?AF=3223&shoid=31ORJQR6YS

... but not without the default.asp. Why could this be? And how would I go about fixing this?

Russ (n00bie... :D )

[nikkiH]

Don't give the server an invalid URI?
I am not certain, but I don't think that's valid according to the RFC.

Whatever you come up with, it will probably have to be done in IIS.
But I'd be interesting in hearing a solution, if you do find one...

[oracleguy]

Or it could be the ASP code you are using to filter it out doesn't handle that situation properly. Post the code and maybe there is an easy fix.

[Rusty Chainsaw]

OK, here's the code... simple enough, but any input would be appreciated.


<%
' Russ' URL stripping code

Session("redirected") = "1"

set Conn = Server.CreateObject("ADODB.Connection")
Conn.Open "DSN=DSN to CommerceX;UID=xxx;PWD=xxxx"

If Len(Lcase(request.QueryString("af"))) <> 0 then
If Request.QueryString("af") <> "" then
affiliate_id = Request.QueryString("af")
Session("af") = Request.QueryString("af")
End If
End If

' ----------------------------------
' c_brnd
If Len(request.QueryString("c_brnd")) <> 0 then
lvsql= "SELECT * FROM K_brand_label WHERE K_brand_label.igroup='" & Request.QueryString("c_brnd") &"'"
Set rs_validate = Conn.Execute(lvsql)

If Not rs_validate.EOF then
BrandID = "c_brnd=" & Request.QueryString("c_brnd")
UseBrandID = 1
Else
Session("redirected") = "0"
fourohfour_Needed = True
End If


End If

' ----------------------------------
' c_pdct
If Len(request.QueryString("c_pdct")) <> 0 then
lvsql= "SELECT * FROM K_product_label WHERE K_product_label.id='" & Request.QueryString("c_pdct") &"'"

Set rs_validate = Conn.Execute(lvsql)

If Not rs_validate.EOF then
ProductID = "c_pdct=" & Request.QueryString("c_pdct")
UseProductID = 1
RedirPage = "prod.asp"

Else
Session("redirected") = "0"
fourohfour_Needed = True
End If

End If

' ---------------------------------
' v_article
If Len(request.QueryString("v_article")) <> 0 then
lvsql= "SELECT * FROM K_main WHERE K_main.number='" & Request.QueryString("v_article") &"'"
'Response.Write lvsql & "<br>"

Set rs_validate = Conn.Execute(lvsql)

If Not rs_validate.EOF then
ArticleID = "v_article=" & Request.QueryString("v_article")
UseArticleID = 1
Else
Session("redirected") = "0"
fourohfour_Needed = True
End If

End If

' ----------------------------------
' take care of k_article

If Len(request.QueryString("k_article")) <> 0 then

lvsql= "SELECT * FROM K_main WHERE K_main.number='" & Request.QueryString("k_article") &"'"

Set rs_validate = Conn.Execute(lvsql)

If Not rs_validate.EOF then
ArticleID = "v_article=" & Request.QueryString("k_article")
UseArticleID = 1
Else
Session("redirected") = "0"
fourohfour_Needed = True
End If

End If

If Request.ServerVariables("SCRIPT_NAME") = "" then
Session("redirected") = "0"
Response.End
End If

' one more check, for weird/old variables - if present, then do redirect
' Variables to test: shoid, mscsid, type, lst, wali

If Len(Request.QueryString("shoid")) or Len(Request.QueryString("mscsid")) or Len(Request.QueryString("type")) or Len(Request.QueryString("list")) or Len(Request.QueryString("wali")) then
Session("redirected") = "0"
End If

' do AF test - test if it exists and session is not set, then redirect

If Len(LCase(Request.QueryString("af"))) then
If Request.QueryString("af") = Session("af") then
Session("redirected") = "0"
End If
End If

' ----------------------------------

If UseProductID = 1 then
PageDirect = "prod.asp?" & ProductID
ElseIf UseArticleID = 1 then
PageDirect = "item.asp?" & ArticleID
ElseIf UseBrandID = 1 then
PageDirect = "brand.asp?" & BrandID
Else
PageDirect = "default.asp"
End If

AppendHist = ""

If UseProductId = 1 or UseBrandID = 1 or UseArticleID = 1 or PageDirect = "default.asp" then
' do nothing, don't pass hist
AppendHist = ""
Else
If Request.QueryString("hist") <> "" then
AppendHist = "&hist=" + Request.QueryString("hist")
Else
AppendHist = ""
End If
End If

If fourohfour_Needed = false then
If Session("redirected") = "0" then
Session("redirected") = "1"
Response.Status="301 Moved Permanently"
Response.AddHeader "Location", "http://blah.com/" + PageDirect & AppendHist
Response.End
Else
Session("redirected") = "1"
End If

ElseIf fourohfour_Needed = true then
If Session("redirected") = "0" then
Session("redirected") = "1"
Response.Status="404 Page Not Found"
Response.Write "<meta http-equiv=""refresh"" content=""0;URL=http://blah.com/404.asp"">"
Response.End
Else
Session("redirected") = "1"
End If

End If
%>




The session stuff is to stop the redirect iterating if it doesn't need to, as the routine is called at the top of all pages in the site.

[neocool00]

How are you doing the redirect? Are you just redirecting to "?AF=3223&shoid=31ORJQR6YS" or are you putting the full url "http://mysite.com/?AF=3223&shoid=31ORJQR6YS"? I did a little testing on my localhost and w/o specifying a page, I was always redirected back to default.asp. It could very well be an IIS setting (or version as I am running XP Pro w/ IIS 5).

[Rusty Chainsaw]

How are you doing the redirect? Are you just redirecting to "?AF=3223&shoid=31ORJQR6YS" or are you putting the full url "http://mysite.com/?AF=3223&shoid=31ORJQR6YS"? I did a little testing on my localhost and w/o specifying a page, I was always redirected back to default.asp. It could very well be an IIS setting (or version as I am running XP Pro w/ IIS 5).

Is it directing back to default.asp without changing the displayed URL though? I need to get it so the URL, if it is going to go back to default.asp, says just "default.asp" with no querystring.