hiding querystring in URL

if I have a page which insert info into a DB, and then redirects the user to
another page, with the following code:

Response.Redirect("index.asp?p=confirm&Action=" & Request("Action") &
"&FName=" & Server.URLEncode(Request("FName")) & "&Email=" &
Request("Email") & "&newcode=" & Server.URLEncode(newcode) & "")

how can I hide the stuff after the URL? This is what I get:

http://hobbit/newhp/index.asp?p=confirm&Action=New&FName=Rudi&Email=theesain
t@bonzai.org.za&newcode=M7EW1RZO

This is not a form, so it's not todo with the GET / POST actions.

--

Kind Regards
Rudi Ahlers
+27 (82) 926 1689

Greater love has no one than this, that he lay down his life for his friends
(John 15:13).

Andrew
Sun Apr 11 08:11:57 CDT 2004

Lord Merlin wrote:
> if I have a page which insert info into a DB, and then redirects the
> user to another page, with the following code:
>
> Response.Redirect("index.asp?p=confirm&Action=" & Request("Action") &
> "&FName=" & Server.URLEncode(Request("FName")) & "&Email=" &
> Request("Email") & "&newcode=" & Server.URLEncode(newcode) & "")
>
> how can I hide the stuff after the URL? This is what I get:
>
>
http://hobbit/newhp/index.asp?p=confirm&Action=New&FName=Rudi&Email=theesain
> t@bonzai.org.za&newcode=M7EW1RZO
>
> This is not a form, so it's not todo with the GET / POST actions.

Well, that *is* a get request, but anyhoo:

1. Hiding querystrings from the browser address bar is usually done with
a frameset that fills the viewport. Don't go this route, users can't
bookmark your pages and if search engines do find your content then
incoming links go deep into the site without the frameset anyway so it's
useless at best.
2. Pass the primary key id on the querystring instead.
3. Use Server.Transfer
4. Use Sessions (either native or custom-built)
5. Re-write the page logic to not require the redirect
--
Andrew Urquhart
- FAQ: www.aspfaq.com
- Archive: www.tinyurl.com/38kzx
- Contact: www.andrewu.co.uk/contact/
- Employ me: Front/middle tier ASP developer with WAI & web standards

Jonas
Sun Apr 11 08:07:22 CDT 2004

You could imitate a form and then submit it (for example using JavaScript)

"Lord Merlin" <SP4M_Rudi@SP4M_Bonzai.org.za_SP4M> wrote in message
news:qoGdnSr6tewkouTdRVn-gw@is.co.za...
> if I have a page which insert info into a DB, and then redirects the user
to
> another page, with the following code:
>
> Response.Redirect("index.asp?p=confirm&Action=" & Request("Action") &
> "&FName=" & Server.URLEncode(Request("FName")) & "&Email=" &
> Request("Email") & "&newcode=" & Server.URLEncode(newcode) & "")
>
> how can I hide the stuff after the URL? This is what I get:
>
> This is not a form, so it's not todo with the GET / POST actions.

Lord
Sun Apr 11 08:51:57 CDT 2004

"Andrew Urquhart" <reply@website.in.sig> wrote in message
news:mubec.182$rR.172@newsfe1-win...
: Lord Merlin wrote:
: > if I have a page which insert info into a DB, and then redirects the
: > user to another page, with the following code:
: >
: > Response.Redirect("index.asp?p=confirm&Action=" & Request("Action") &
: > "&FName=" & Server.URLEncode(Request("FName")) & "&Email=" &
: > Request("Email") & "&newcode=" & Server.URLEncode(newcode) & "")
: >
: > how can I hide the stuff after the URL? This is what I get:
: >
: >
:
http://hobbit/newhp/index.asp?p=confirm&Action=New&FName=Rudi&Email=theesain
: > t@bonzai.org.za&newcode=M7EW1RZO
: >
: > This is not a form, so it's not todo with the GET / POST actions.
:
: Well, that *is* a get request, but anyhoo:
:
: 1. Hiding querystrings from the browser address bar is usually done with
: a frameset that fills the viewport. Don't go this route, users can't
: bookmark your pages and if search engines do find your content then
: incoming links go deep into the site without the frameset anyway so it's
: useless at best.
: 2. Pass the primary key id on the querystring instead.
: 3. Use Server.Transfer
: 4. Use Sessions (either native or custom-built)
: 5. Re-write the page logic to not require the redirect
: --
: Andrew Urquhart
: - FAQ: www.aspfaq.com
: - Archive: www.tinyurl.com/38kzx
: - Contact: www.andrewu.co.uk/contact/
: - Employ me: Front/middle tier ASP developer with WAI & web standards
:
:
Ok, fair point, but ......
1) The site was originally in frames, and now I'm taking it out of frames
2) I don't follow you on this one.
3) sounds like a good option to try out
4) sound like a good option to try out
5) different options require different redirects, thus I can't have all the
redirected pages' info in one file


--

Kind Regards
Rudi Ahlers
+27 (82) 926 1689

Greater love has no one than this, that he lay down his life for his friends
(John 15:13).

Andrew
Sun Apr 11 09:10:19 CDT 2004

Lord Merlin wrote:
> Andrew Urquhart wrote:
>> 1. Hiding querystrings from the browser address bar is usually done
>> with a frameset that fills the viewport. Don't go this route, users
>> can't bookmark your pages and if search engines do find your content
>> then incoming links go deep into the site without the frameset
>> anyway so it's useless at best.
>> 2. Pass the primary key id on the querystring instead.
>> 3. Use Server.Transfer
>> 4. Use Sessions (either native or custom-built)
>> 5. Re-write the page logic to not require the redirect
>
> Ok, fair point, but ......
> 1) The site was originally in frames, and now I'm taking it out of
> frames
> 2) I don't follow you on this one.
> 3) sounds like a good option to try out
> 4) sound like a good option to try out
> 5) different options require different redirects, thus I can't have
> all the redirected pages' info in one file

1. Well done!
2. You've just done an insert into your database, put the value of the
primary key (e.g. a unique userId) for your new database record into the
querystring. E.g. index.asp?p=confirm&user=1234. In index.asp do a
database lookup for that user's info using the primary key value you
just passed into the page. You still have a querystring visible but it's
shorter and less tempting to modify. As always be aware of the
repercussions of someone modifying your querystring (e.g. being able to
assume someone elses identity, interrupting program flow, SQL insertion,
...)
4. Beware of scalability issues.
--
Andrew Urquhart
- FAQ: www.aspfaq.com
- Archive: www.tinyurl.com/38kzx
- Contact: www.andrewu.co.uk/contact/
- Employ me: Front/middle tier ASP developer with WAI & web standards

Aaron
Sun Apr 11 11:11:51 CDT 2004

Added an article today.
http://www.aspfaq.com/2517

--
Aaron Bertrand
SQL Server MVP
http://www.aspfaq.com/


"Lord Merlin" <SP4M_Rudi@SP4M_Bonzai.org.za_SP4M> wrote in message
news:qoGdnSr6tewkouTdRVn-gw@is.co.za...
> if I have a page which insert info into a DB, and then redirects the user
> to
> another page, with the following code:
>
> Response.Redirect("index.asp?p=confirm&Action=" & Request("Action") &
> "&FName=" & Server.URLEncode(Request("FName")) & "&Email=" &
> Request("Email") & "&newcode=" & Server.URLEncode(newcode) & "")
>
> how can I hide the stuff after the URL? This is what I get:
>
> http://hobbit/newhp/index.asp?p=confirm&Action=New&FName=Rudi&Email=theesain
> t@bonzai.org.za&newcode=M7EW1RZO
>
> This is not a form, so it's not todo with the GET / POST actions.
>
> --
>
> Kind Regards
> Rudi Ahlers
> +27 (82) 926 1689
>
> Greater love has no one than this, that he lay down his life for his
> friends
> (John 15:13).
>
>

Bob
Sun Apr 11 11:15:46 CDT 2004

Aaron Bertrand [MVP] wrote:
> Added an article today.
> http://www.aspfaq.com/2517

You forgot to finish a sentence in option 2 :-)
Bob



--
Microsoft MVP - ASP/ASP.NET
Please reply to the newsgroup. This email account is my spam trap so I
don't check it very often. If you must reply off-line, then remove the
"NO SPAM"

Aaron
Sun Apr 11 11:20:12 CDT 2004

> You forgot to finish a sentence in option 2 :-)

I caught that a couple minutes ago. Thanks!

Lord
Sun Apr 11 11:47:13 CDT 2004

heh, it looks like I cause quite a stir on the NG :)

--

Kind Regards
Rudi Ahlers
+27 (82) 926 1689

Greater love has no one than this, that he lay down his life for his friends
(John 15:13).
"Aaron Bertrand [MVP]" <aaron@TRASHaspfaq.com> wrote in message
news:ekKUfD#HEHA.1944@TK2MSFTNGP11.phx.gbl...
: > You forgot to finish a sentence in option 2 :-)
:
: I caught that a couple minutes ago. Thanks!
:
: