Difference: VarURLPARAM (1 vs. 7)

• • IMPORTANT: There is a risk that this variable can be misused for cross-site scripting (XSS) if the encoding is turned off. The encode="safe" is the default, it provides a safe middle ground. The encode="entity" is more aggressive, but some TWiki applications might not work.
  • URL parameters passed into HTML form fields must be entity ENCODEd.
    Example: <input type="text" name="address" value="%URLPARAM{ "address" encode="entity" }%" />

• • IMPORTANT: There is a risk that this variable could be misused for cross-site scripting (XSS).
  • URL parameters passed into HTML form fields must be entity ENCODEd.
    Example: <input type="text" name="address" value="%URLPARAM{ "address" encode="entity" }%" />

• Notes:
  • URL parameters passed into HTML form fields must be entity ENCODEd.
  • Double quotes in URL parameters must be escaped when passed into other TWiki variables.
    Example: %SEARCH{ "%URLPARAM{ "search" encode="quotes" }%" noheader="on" }%
  • When used in a template topic, this variable will be expanded when the template is used to create a new topic. See TWikiTemplates#TemplateTopicsVars for details.
  • Watch out for TWiki internal parameters, such as rev, skin, template, topic, web; they have a special meaning in TWiki. Common parameters and view script specific parameters are documented at TWikiScripts.
  • If you have %URLPARAM{ in the value of a URL parameter, it will be modified to %<nop>URLPARAM{. This is to prevent an infinite loop during expansion.
  • There is a risk that this variable could be misused for cross-site scripting.

• Note: URL parameters passed into HTML form fields must be entity ENCODEd.

• Related: ENCODE, SEARCH, FormattedSearch, QUERYSTRING

Note If you have %URLPARAM{ in the value of a URL parameter, it will be modified to %<nop>URLPARAM{. This is to prevent an infinite loop during expansion.

• Note: URL parameters passed into HTML form fields must be entity ENCODEd.
• Note: Double quotes in URL parameters must be escaped when passed into other TWiki variables.
  Example: %SEARCH{ "%URLPARAM{ "search" encode="quotes" }%" noheader="on" }%

URLPARAM{"name"} -- get value of a URL parameter

• Returns the value of a URL parameter.
• Syntax: %URLPARAM{"name"}%
• Supported parameters:

  Parameter:	Description:	Default:
  "name"	The name of a URL parameter	required
  default="..."	Default value in case parameter is empty or missing	empty string
  newline="<br />"	Convert newlines in textarea to other delimiters	no conversion
  encode="entity"	Encode special characters into HTML entities. See ENCODE for more details.	no encoding
  encode="url"	Encode special characters for URL parameter use, like a double quote into %22	no encoding
  multiple="on" multiple="[[$item]]"	If set, gets all selected elements of a <select multiple="multiple"> tag. A format can be specified, with $item indicating the element, e.g. multiple="Option: $item"	first element
  separator=", "	Separator between multiple selections. Only relevant if multiple is specified	"\n" (new line)

• Example: %URLPARAM{"skin"}% returns print for a .../view/TWiki/VarURLPARAM?skin=print URL
• Note: URL parameters passed into HTML form fields must be entity ENCODEd
• Note: When used in a template topic, this variable will be expanded when the template is used to create a new topic. See TWikiTemplates#TemplateTopicsVars for details.
• Note: There is a risk that this variable could be misused for cross-site scripting.
• Related: ENCODE, SEARCH, FormattedSearch, QUERYSTRING