I am a bit puzzled by this myself. If for some reasons I would like to encode any valid url into valid pathname, say, to be used on an image proxy with an url structure like:  http://image-proxy/hash_of_url/encoded_url   Is there an efficient way to achieve encoded_url in javascript? I am on node.js runtime.  I need to do this because it would be used by another proxy not in my control, which had problem with an url like this:  http://image-proxy/hash_of_url/?url=encoded_url   PS: hash_of_url is a hmac digest of original url, to ensure url is generated by server, but that's not important to my question.
11741
How do you safely encode a URL using JavaScript such that it can be put into a GET string?  var myUrl = "http://example.com/index.html?param=1&amp;anotherParam=2"; var myOtherUrl = "http://example.com/index.html?url=" + myUrl;   I assume that you need to encode the myUrl variable on that second line?
59961
I've got a C# program with values in a config file.  What I want is to store ampersands for an url value like...  &lt;appSettings&gt;   &lt;add key="myurl" value="http://www.myurl.com?&amp;cid=&amp;sid="/&gt; &lt;/appSettings&gt;   But I get errors building my site.  The ampersand is not allowed.  I've tried various forms of escaping the ampersands to no avail.  Anyone know of the correct form to do this?  All suggestions are welcome.
123007
We have a high security application and we want to allow users to enter URLs that other users will see.  This introduces a high risk of XSS hacks - a user could potentially enter javascript that another user ends up executing. Since we hold sensitive data it's essential that this never happens.  What are the best practices in dealing with this? Is any security whitelist or escape pattern alone good enough?   Any advice on dealing with redirections ("this link goes outside our site" message on a warning page before following the link, for instance)  Is there an argument for not supporting user entered links at all?    Clarification:  Basically our users want to input:      stackoverflow.com   And have it output to another user:  &lt;a href="http://stackoverflow.com"&gt;stackoverflow.com&lt;/a&gt;   What I really worry about is them using this in a XSS hack. I.e. they input:     alert('hacked!');   So other users get this link:  &lt;a href="javascript:alert('hacked!');"&gt;stackoverflow.com&lt;/a&gt;   My example is just to explain the risk - I'm well aware that javascript and URLs are different things, but by letting them input the latter they may be able to execute the former.  You'd be amazed how many sites you can break with this trick - HTML is even worse. If they know to deal with links do they also know to sanitise &lt;iframe&gt;, &lt;img&gt; and clever CSS references?  I'm working in a high security environment - a single XSS hack could result in very high losses for us. I'm happy that I could produce a Regex (or use one of the excellent suggestions so far) that could exclude everything that I could think of, but would that be enough?
58268
In Java, given a java.net.URL or a String in the form of http://www.example.com/some/path/to/a/file.xml , what is the easiest way to get the file name, minus the extension? So, in this example, I'm looking for something that returns "file".   I can think of several ways to do this, but I'm looking for something that's easy to read and short.
52192
Sometimes I get the url of a video embedded in a webpage and download it, just to find the file has no extension name. I can play the video with a player, so it must be legal. How do I determine the extension name of the video file in such circumstance?
92637
The Community bot already ran through posts to convert internal http:// links to https://, which is great, but it needs to be run one more time: this time, it needs to convert links of this format:  https://meta.example.stackexchange.com/   to this format:  https://example.meta.stackexchange.com/   Our old meta pages on RPG Stack Exchange contain lots of internal meta references which still follow the old (first) domain protocol.  This link points to rpg.meta and is fine:   However this link points to meta.rpg and contains a privacy error in Chrome because meta.rpg.stackexchange.com doesn't actually have a certificate:         As you can see this means people trying to visit meta links posted before a few months ago are left with no obvious option of how to actually reach the intended destination. They'd also be confused why an obviously Stack Exchange URL is breaking.  Please run that Community edit script another time!  Reported locally on our RPG.SE meta as well here:
100483
I'm trying to register a custom protocol to an application on the Mac, i.e:   User clicks on link with "abcdef://some/url/here" An installed application is launched with the above string passed as the first param   I've done this successfully on Windows using the information from this question:    I would prefer to find something that is browser-independent, in other words at the OS level. I would also like to automate this registration through a shell script, so hopefully there is a way to do this that doesn't involve the GUI.  Thanks!
19436
How can I encode and decode  (URL encoded) strings on the command line?  I'm looking for a solution that can do this:  $ percent-encode "ændrük" %C3%A6ndr%C3%BCk $ percent-decode "%C3%A6ndr%C3%BCk" ændrük
73621
Is there any way to create the query parameters for doing a GET request in JavaScript?  Just like in Python you have , which takes in a dictionary (or list of two tuples) and creates a string like 'var1=value1&amp;var2=value2'.
91117
I'm looking for a good approach to manipulate some JS code from within a module call. (Using Drupal 6.)  I have a set of JavaScript functions I need to add to a page. (Regular JavaScript, no jQuery.) Unfortunately they rely on some variables from the page they are shown on. So my current approach is to generate all the JavaScript from within PHP code which results in a whole lot of escaped strings like $output .= '  var url = "'. $url . '";' . "\n";, which is not so nice after 20-30 lines of code.  So I would like to move all the JavaScript code into it's own .js file, and find a way to inject my variables. So far, the only solution I could come up with is putting it in a temporary file, read that, modify and save it to the /files directory. But is there another, more preferred way?
70318
I am trying to set particular javascript files for a specific node page by getting the path alias. like this:  $path=drupal_get_path_alias();   if($path == 'about-us')   drupal_add_js(drupal_get_path('theme', 'mytheme') . "/page-download.js");   which it doesnt work.  But when i add the particular javascript file to my .info file it works.  Also in other pages i will have to unset some of the javascript files if the above does not work but still unsetting javascripts does not work.   unset($vars['js']['all']['page-download.js']);
13909
When encoding a query string to be sent to a web server - when do you use escape() and when do you use encodeURI() or encodeURIComponent():  Use escape:  escape("% +&amp;=");   OR  use encodeURI() / encodeURIComponent()  encodeURI("http://www.google.com?var1=value1&amp;var2=value2");  encodeURIComponent("var1=value1&amp;var2=value2");
35033
As per Yahoo's much-ballyhooed , we serve up static content from a CDN using far-future cache expiration headers. Of course, we need to occasionally update these "static" files, so we currently add an infix version as part of the filename (based on the SHA1 sum of the file contents). Thus:  styles.min.css   Becomes:  styles.min.abcd1234.css   However, managing the versioned files can become tedious, and I was wondering if a GET argument notation might be cleaner and better:  styles.min.css?v=abcd1234   Which do you use, and why? Are there browser- or proxy/cache-related considerations that I should consider?
26270
I am using jQuery. How do I get the path of the current URL and assign it to a variable?  Example URL:  http://localhost/menuname.de?foo=bar&amp;amp;number=0
99762
Currently, neither protocol-relative URLs, nor relative URLs, are recognized by the system as pointing to questions to be added to the "Linked" list for the current question. Given the pending switch to using HTTPS on Stack Overflow, and later on the entire Stack Exchange network, we should, at least, recognize protocol-relative links to questions as "Linked".  Investigation  I entered the following links into a comment to point to a potential duplicate1:  [Is there a JavaScript/jQuery DOM change listener?](//stackoverflow.com/q/2844565) [Is there a JavaScript/jQuery DOM change listener?](//stackoverflow.com/questions/2844565) [Is there a JavaScript/jQuery DOM change listener?](/q/2844565) [Is there a JavaScript/jQuery DOM change listener?](/questions/2844565)   All of the above resulted in valid links to the question. None of these were picked up by the system to be considered as "Linked". By "Linked", I mean that the sidebar shows a "Linked" heading. What I expected to see was:    In order to get the question to show up as "Linked", I had to use a fully qualified URL:  [Is there a JavaScript/jQuery DOM change listener?](http://stackoverflow.com/q/2844565)   The code  We know from  that the code responsible for identifying "Linked" questions is:  public static Regex GetQuestionUrlRegex() {     return new Regex(@"https?://" + Regex.Escape(Current.Site.BaseHostAddress) + @"(?:/q(uestions)?/(?&lt;qid&gt;\d+)|/a/(?&lt;aid&gt;\d+))", RegexOptions.IgnoreCase); }   It seams that the Regex could be changed to something like (untested):  public static Regex GetQuestionUrlRegex() {     return new Regex(@"(?:https?:)?(?://" + Regex.Escape(Current.Site.BaseHostAddress) + @")?(?:/q(uestions)?/(?&lt;qid&gt;\d+)|/a/(?&lt;aid&gt;\d+))", RegexOptions.IgnoreCase); }   This change would allow the recognition of fully qualified links, protocol-relative links, and relative links.  A potential issue is that I don't know what text is being checked by this generated Regex. If this regular expression is being used to check the entirety of the raw HTML, then allowing it to pick up such shortened URLs may not be appropriate. If it is only testing active links, then it is reasonable to recognize the shorter, valid, URLs.    Notes:   A  regarding only relative links was declined at that time.  I'm unsure if this post should be considered a bug report or a feature request. I consider it a bug. However, given the previously declined bug report, the current functionality could reasonably be considered a misfeature. In such case, this would then be a feature request.   1. I'm currently out of close votes, so was unable to vote to close the question.
6814
I am using the java based neo4j graph database on lubuntu 15.04.   The neo4j HTTP authentication header uses base64 encoding of 'username:password' (not including quotes). Using wireshark I can see the base64 code generated by neo4j.   However if I use the ubuntu coreutils base64 to encode the same string I get a slightly different encoding. This encoding is not accepted by neo4j.  Both encodings decode to the correct username:password string  Example   username=neo4j and password=@N  Neo4j gives the encoded value of neo4j:@N as bmVvNGo6QE4= which decodes to neo4j:@N as expected  $ echo 'bmVvNGo6QE4=' | base64 --decode neo4j:@N   Ubuntu coreutils base64 returns the encoded value of neo4j:@N as bmVvNGo6QE4K (which differs in the last character) but still decodes correctly;  $ echo 'neo4j:@N' | base64 bmVvNGo6QE4K $ echo 'bmVvNGo6QE4K' | base64 --decode neo4j:@N   Why is this? What do I need to do get consistent encoding?
100409
I am asking this because whenever I hover over a link to a home page (e.g. http://www.example.com), I notice that a trailing slash is always added (as observed on the status bar of the browser) whether the home page link contains a href attribute that ends with a slash or not. But whenever I am on the home page, the URL on display will not have a trailing slash.  I tried entering a slash to the URL in the URL bar. And with Firebug enabled, I notice that the site always return a 200 OK status. An article  discussing this states that having a slash at the end will avoid a 301 redirection. But I am not seeing any redirection, even on  page.  Could this be a browser feature that is appending the slash?