uri query question

Actually I needed to fix this for a customer and came up with a workaround using findstr (Click here).

I'm guessing this would be faster than a loop or a regex. Replace $query with [HTTP::query] and update the skip count in the findstr commands based on how long the parameter name you're looking for is. You could calculate the skip count in the rule, but that would be less efficient.

 
 when RULE_INIT { 
  
     Find the value for the first instance of a parameter name of "aa" in the query string 
  
     Test query string 
    set query "aaa=111&aa=11&a=1&aa=22" 
  
     Test query string 
    set query "aa=11" 
  
     The parameter name to get the value for 
    set param_name aa 
  
     Check if query string starts with the parameter name and =. 
      Need to hardcode the length of the parameter name + 1 for findstr 
    if {$query starts_with "$param_name="}{ 
  
       log local0. "$param_name = [findstr $query "$param_name=" 3 &]" 
  
    } else { 
  
        Parameter wasn't at the start of the query string, so check for &param_name= in the query string 
         Need to hardcode the length of the parameter name + 2 for findstr 
       log local0. "$param_name = [findstr $query "&$param_name=" 4 &]" 
    } 
    log local0. "Incorrect value from URI::query: $param_name = [URI::query ?$query $param_name]" 
 } 
 

Aaron