8

You have implemented a Cross Site Scripting (XSS) vulnerability. This type of injection vulnerability can be used by an attacker to steal the credentials of your users, or make users perform actions on your site or against other sites without their knowledge. For more information about XSS see wikipedia: http://en.wikipedia.org/wiki/Cross-site_scripting ...


6

Why would this be considered harmful? They're perfectly valid URLs that lead to perfectly valid pages. As long as they are available to humans and search engines alike this is fine.


6

Query parameters can be used for many purposes. Some of them don't specify the page content and some of them do. If the query parameter is used to specify the content loaded onto the page, then it should be included in your canonical URL. If the query parameter is used for tracking or changes an insignificant part of the page, then it should be left out ...


4

This should work for files of any extension: RewriteEngine on RewriteCond %{QUERY_STRING} ^/(.*\..*)$ RewriteRule ^index\.php$ http://www.newsite.com/%1? [L,R=301] Or to redirect the entire path and file request: RewriteEngine on RewriteCond %{QUERY_STRING} ^/(.*)(\..*)$ RewriteRule ^index\.php$ http://www.newsite.com/%1%2? [L,R=301]


4

URLs that differ even by one character are still considered to be unique. Fortunately, Google Analytics provides an option to Exclude URL Query Parameters, as covered here: 1.) Click Admin at the top of any Analytics page. 2.) Use the menu in the View column to select the view you want to edit. 3.) Click View Settings. 4.) Under Exclude URL Query ...


4

If you have the mod_rewrite module installed, then you can put this in your .htaccess file in the root folder of your website (which usually is the public_html folder): RewriteEngine On RewriteRule ^\?utm_source\=dlvr.it\&utm_medium\=twitter$ - [R=403,NC,L] You might have to remove the \ from the =, I can't remember if equals needs escaping. Another ...


4

I think you have two problems. One, the rewrite are checked in order and you put the more constraining one after the least constraining one (i.e. the redirect with your query string should be first.) Second, we have another problem concerning the query string. It includes an anchor. That is never sent to the server (anything after #... is client side only.)...


3

You don't want to redirect them - that will probably break your site's functionality. There are various means of managing parameters for SEO purposes; since you mention Google Webmaster Tools, you may wish to look at their parameter management tool. In brief, you can instruct Google how to handle different parameters on your site, e.g., index them, index a ...


3

I have an application that has started seeing this issue around noon on Nov 20, 2014 (Eastern), with near the exact same issues mentioned. I was able to connect with one of our users who indicated she was using the Hola.org plugin and I was then able to reproduce the error after installing it myself on Chrome. Funny thing is although my site was ...


3

Adding a query-string key/value pair to a static resource (such as an image, CSS or JavaScript) can cause caching issues. Specifically, since you mentioned Firefox, your issue could be related to a 'Cache collision', where: The Firefox disk cache hash functions can generate collisions for URLs that differ only slightly, namely only on 8-character ...


3

I think you're reasonably close. However, & (ampersands) are not HTML encoded in the request, so you should check just for & and not &. Special HTML characters should only be HTML encoded in your source HTML document. I think the few omitted spaces (argument delimiters) are perhaps just due to the copy/paste of your code? Try this (in ....


3

Google doesn't want to index search results. Matt Cutts said so: http://www.mattcutts.com/blog/search-results-in-search-results/ Google now penalizes sites that try that. Google considers search pages to be very low quality landing pages. Why should a user click off a page of search results, only to land on another? If you think you can target these ...


3

?utm_source=dlvr.it&utm_medium=twitter utm_source and utm_medium are used by Google Analytics (and possibly other trackers) to monitor campaigns, so blocking access purely on this query string does not "feel right", however, if this is correct in your situation then ok... An important point to realise with query strings is that they cannot be matched ...


3

Partly depends on which question mark you want to keep. You have two question marks in the URL that you're trying to resolve to & that won't work. I'll assume that the last question mark is the one you want to keep RewriteCond %{QUERY_STRING} (?:&|^)s=(\w+) RewriteRule ^ http://www.example.com/search_gcse/?q=%1


3

Is punctuation perfectly acceptable in the middle of a query string? Yes, but it depends on the punctuation. RFC 3986 Section 3.4 defines what characters are permitted in the query string part of the URL: query = *( pchar / "/" / "?" ) pchar = unreserved / pct-encoded / sub-delims / ":" / "@" unreserved = ALPHA / DIGIT / "-" / "." / "_" / "~" ...


3

Internal search results shouldn't actually be indexed. Google's Webmaster Guidelines state: Use robots.txt to prevent crawling of search results pages or other auto-generated pages that don't add much value for users coming from search engines. Matt Cutts weighed in when this was previously discussed on Google’s webmaster help group. I quite like the ...


3

While all internal search result urls contain no unique information, they are for SEO purposes irrelevant and harmful. Making internal search with GET you produce search result urls, which you later should exclude from indexing (and from crawling, because of overspending of crawl budget for useless urls). But using POST on internal search you a single ...


2

You'll want to make sure you have the Microsoft URL Rewrite Module installed, and create a rule template as covered step-by-step here: IIS.net - User Friendly URL - rule template The other way to do this is edit your web.config file, as covered here (substituting your URL's under "The lines to modify...").


2

domain.com/product/3343/ The benefits of using the above URL structure are: Easier Recognition When displayed in SERP (Search Engine Result Pages), the above link is more identifiable to visitors as to what content it might lead to. The same is true when the link text isn't provided or available, such as for those viewers with accessibility issues or ...


2

This isn't really about Google, it's about the specification for URLs - lower and uppercase are different URLs. This applies to query string parameters as well. If Google knows of 2 different URL variants, it treats them initially as 2 separate URLs. However, if it turns out they have the same content, Google is generally smart enough to count them as the ...


2

First things first, as @LazyOne said, the third-party URLs are not being properly generated, so the expectation is server to fail - as it is failing right now as you described. Note that valid HTML and valid URLs are a different thing. You should escape entities for HTML content, but this is not true when writing links, image addresses, and calls for ...


2

This answer on stackoverflow claims that some browsers react differently to hitting enter in the address bar vs clicking on a link when the url has a query string: https://stackoverflow.com/a/85386/1145388 When you are testing, make sure you are clicking on links rather than refreshing or hitting enter in the url bar.


2

Can you change the app to use a different querystring name? Or in the GA tracking on the page, pass a custom page view that doesn't have that parameter? If that's not possible, then have you tried creating a filter to change the querystring? It would be an "advanced" filter under "custom filter" on the filters screen. Here's more information from Google.


2

It appears that the only thing that you would need to escape in that URL would be the : https://organization.proxive.se/proxive/https%3A//www.google.com/ Then your URL wouldn't use any disallowed characters and the directories would still be on the sub URL for supporting some relative links. I just want to point out that not all relative links will work. ...


2

Pl. try this: RedirectMatch 301 ^/royatlon.north.com/cybersource/(.*) https://media.north.com/$1


2

On the long term, no, but on the short term there might be some fluctuation. There are two possibilities to mitigate this issue: - In Google Webmaster Tools, in Crawl > URL Parameters, you can tell Google which parameters to ignore. - Set a canonical without the old parameter on url pages still having the old parameter.


2

If you "dynamically add that meta tag" for only the first URL then it will not affect indexing of the second. Whilst it might be the same file (product.aspx) that processes both requests, they are two different URLs.


2

A literal question mark in the URL marks the start of the query string, so you can test if the query string contains anything and redirect if it does. Using Apache mod_rewrite in .htaccess: RewriteEngine On RewriteCond %{QUERY_STRING} . RewriteRule (.*) /$1? [R=301,L] The RewriteRule pattern matches against the URL-path, which notably excludes the query ...


2

Even easier: RewriteCond %{QUERY_STRING} . RewriteRule ^ %{REQUEST_URI}? [R=301,L]


2

www.example.com/products?category=A&category=B www.example.com/products?category=B&category=A These two URLs are technically different. So if they are both available for indexing and return exactly the same content then yes, it's duplicate content. If those two URLs return the same content then Google is only going to return one of them in the ...


Only top voted, non community-wiki answers of a minimum length are eligible