I came across an interesting little problem with putting query string parameters for an HTTP request into a SharePoint page.
I was using a Dataview web part, which accepts query string parameters into the filter that it runs over the data that it’s going to display. That’s pretty cool - I had a list of items with a status column, and I wanted to be able to filter the items based on that status, and that the status would come from the query string. However, on the page, I also wanted to show a title with what was being filtered by in it. So, for example, my url might read:
http://server/site/page.aspx?status=Ready
And I wanted the title in the page to read “Filtering by ‘Ready‘”.
What I didn’t appear to be able to do was to just use the request object . Something like
<%= Request.QueryString.ToString() %>
won’t work as code blocks aren’t, apparently, allowed in the file - the error message is “code blocks are not allowed in this file”. Okay, given that SharePoint designer is supposed to open these pages up to ‘Power Users’ I do get why code blocks aren’t allowed. But I really wanted to write code, and there had to be a way to do that. Well, Kirk Allen Evans has figured out how - you have to enable them in the PageParserPaths section of the web.config file. (It’s strange how easy it is to forget the web.config file that controls SharePoint sometimes). Just to repeat his example (in case blue and red on black is difficult to read):
<PageParserPaths>
<PageParserPath VirtualPath="/pages/*" CompilationMode="Always" AllowServerSideScripting="true" />
</PageParserPaths>
This example allows code blocks for all files under the /pages directory of my web application - it’s worth noting that this is for the web application in IIS, not a SharePoint site collection or the like.
Okay, so that works - great. However, there are security implications, and this is probably best only used for development environments. I’ve written a bit about under what conditions our inline code will run.
In our instance our customer is kind of reluctant to make changes on their server. Changing the web.config file would be a bit of a bit deal. (As a side note, this is a bit restrictive - I think a blog posting on that is due sometime). So what could we do without a server footprint?
Well, without code in the page, we would need a web control to call in that page - that would work also. It’d be trivial to write one. However, that requires deployment, marking as safe in the web.config file, etc., so really that just pushes the problem into another file.
Thus, I ended up getting a bit ‘old skool’ - JavaScript in the page to write the value from the query string on the client. I came up with:
<script type="text/javascript">
var query = window.location;
var regex = /letter=([^&=]+)/i;
var match = regex.exec( query );
if( match != null ) {
document.write( “Filtering by ‘” + match[1] + “‘” );
}
</script>
What this code does is it gets the page’s url (window.location), runs a regular expression looking for the ‘letter’ parameter, and if it find one, it outputs some text to the document. A bit noddy, but simple and it works - with no server footprint. Of course, you do need JavaScript enabled…
