IIS 5.0 URLEncodes URLs passed to Response.Redirect (267883)

SYMPTOMS

When you view an Active Server Pages (ASP) page that uses the server-side Response.Redirect method in a Web browser, you may receive the following error message:

HTTP 404 - File not found
Internet Information Services

Note The ASP page works fine when it is hosted on Internet Information Server 4.0, but when the page is hosted on Internet Information Services 5.0, the error occurs.

CAUSE

The Response.Redirect method takes one argument (a string) that causes the browser to attempt a connection to a different Uniform Resource Locator (URL). Under Internet Information Services 5.0 the URL is encoded, but on Internet Information Server 4.0 it is not encoded. The error that is described in the "Symptoms" section usually occurs because the string that is passed to the Response.Redirect method is already URL-encoded. Internet Information Services 5.0 takes the encoded string and then encodes the string a second time, thus resulting in a URL that does not exist.

For example, the following code sample attempts to redirect to a file that is named "Page,One.asp", in which the file name has been URL-encoded:

Response.Redirect("Page%2COne%2Easp")

If the page is hosted on Internet Information Services 5.0, the Response.Redirect method sends a message to the browser to request the new URL that has been encoded a second time. The requested file name is now incorrect, as in the example shown in the resolution section:

Page%252COne%252Easp

Because "Page%252COne%252Easp" does not exist on the server, the browser will receive the "HTTP 404 - File Not Found" response.

Note You may see unexpected behavior from Internet Information Services 5.0 if you use the Response.Redirect method together with either the UrlEncode method or the UrlPathEncode method.

RESOLUTION

To resolve this problem, you can test to see which version of Internet Information Server/Services is being used and then use the Microsoft JScript unescape() function in your code if necessary. When you use the unescape() function, all characters that are encoded with the %xx hexadecimal form are replaced by their ASCII character set equivalents. Here is an example:

<SCRIPT LANGUAGE=vbscript RUNAT=Server>
strIISVersion = Request.ServerVariables("SERVER_SOFTWARE")
If (strIISVersion = "Microsoft-IIS/4.0") Then
	Response.Redirect "Page%2COne%2Easp"
Else
	Response.Redirect unescape("Page%2COne%2Easp")
End If
</SCRIPT>

Additionally, you can use the following script to manually encode the URL if the server is Internet Information Server 4.0 and leave it un-encoded if the server is Internet Information Server 5.0 (5.0 encodes it automatically):

<SCRIPT LANGUAGE=vbscript RUNAT=Server>
strIISVersion = Request.ServerVariables("SERVER_SOFTWARE")
If (strIISVersion = "Microsoft-IIS/4.0") Then
	Response.Redirect Server.URLEncode("Page,One.asp")
Else
	Response.Redirect "Page,One.asp"
End If
</SCRIPT>