ASP.Net Query String and Usage

Nuelson Penuel Friday, August 28, 2020 ASP.Net


Table Of Contents
What is Query String?
Advantages of Query String
Disadvantages of Query String

What is Query String?


A query string is a parameter or group of parameters that are passed from one page to another. A query string is very useful mostly when we want to pass a value or values from one page to another. 
A query string is not limited to only one technology meaning it can be used in .html, .aspx, .asp, .php files and will still perform the same function.
A query string is always appended to the site url. A query string always come immediately after the question mark (?) symbol in a url and multiple query strings are demarcated or separated using ampersand (&) symbol.
A query string collection is used to retrieve variable values from the unified resource locator (url). 

But query string are not meant to be used for transmission of large data as they individual query string is limited to the length of 255 characters.
Also query string cannot be used to transmit sensitive information such as Username, password, card details e.t.c without proper encryption because they are visible to users at the address or url bar.

Advantages of Query String


1. Supported by all the browsers
2. No extra effort is needed to code. 
3. Easy to use.

Disadvantages of Query String


1. Query string attributes and values are visible to the end user hence can be easily manipulated
2. There is a limit to URL length of 255 characters.

I am going to demonstrate how to use query string in ASP.Net website. In this example, am using two pages login.aspx and welcome.aspx

So follow these steps carefully.

Here is the HTML source for login page
<%@ Page Language="VB" AutoEventWireup="true"  CodeFile="login.aspx.vb" Inherits="_login" EnableViewState="false" Debug="true" Trace="true" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >
    <head runat="server">
        <title>Cookies Example</title>
    </head>
    <body>
        <form id="form1" runat="server">
<asp:Label ID="lblstatus" runat="server" Text="" /><br/>
            <div>Username<br/>
                <asp:TextBox ID="txtusername" Text="" runat="server"/><br/>
Password<br/>
                <asp:TextBox ID="txtpassword" Text="" runat="server"/><br/>
<asp: Button ID="btnlogin" Text="Login" runat="server"/>
            </div>
        </form>
    </body>
</html>


Here is the code behind to pass query string values. When this button is click, the person's username and password will be saved to pass to the url as query string.

Protected Sub btnlogin_Click(ByVal sender As Object, ByVal e As EventArgs) 
    If txtusername.Text = String.Empty And txtpassword.Text = String.Empty Then
       ScriptManager.RegisterStartupScript(Page,Page.GetType(),"mykey","alert ('Enter username and password');",True)
   Else
      Response.Redirect("welcome.aspx?uname=" & txtusername.Text & "&pwd=" & txtpassword.Text)
End If
End Sub


Now that we have passed the query string from the login page, let us retrieve the information on the landing page which is welcome.aspx.

Here is the HTML source for welcome page
<%@ Page Language="VB" AutoEventWireup="true"  CodeFile="welcome.aspx.vb" Inherits="_welcome" EnableViewState="false" Debug="true" Trace="true" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >
    <head runat="server">
        <title>Query String Example</title>
    </head>
    <body>
        <form id="form1" runat="server">
<asp:Label ID="lblstatus" runat="server" Text="" /><br/>
            <div>Username:  <asp:Label ID="lblusername" Text="" runat="server"/><br/>
Password: <asp:Label ID="lblpassword" Text="" runat="server"/><br/>
            </div>
        </form>
    </body>
</html>


Here is the code behind to retrieve query string values. When the page is loaded, username and password will be retrieved from the url and displayed on the welcome page

Protected Sub Page_Load(ByVal sender As Object, ByVal e As EventArgs) 
    If Not Request.QueryString("uname") And Request.QueryString("pwd") Is Nothing Then
      lbstatus.Text = "Welcome"
lblusername.Text = Request.QueryString("uname")
lblpassword.Text = Request.QueryString("pwd")
Else
 ScriptManager.RegisterStartupScript(Page,Page.GetType(),"mykey","alert ('No information passed as query string');",True)
   
End If
End Sub