Old retiring IIS 5.0 web server has been accepting URLs containing plus (+) for spaces instead of %20 for like 74 years. People have the old URLs bookmarked and stuff so they’ll keep going to them. The content will still exist on the replacement IIS 7 web server. Wouldn’t it be nice to make it transparent?

(Not to mention “foo+bar.pdf” is sane, but “foo%20bar.pdf” reads “foo percent twenty bar”, awkwardly. )

The problem is that IIS7 by default considers naked plusses in the URL as scary and sends a 404.11, URL_DOUBLE_ESCAPED error. Even if you convince it the URL is OK, it no longer maps plus to space and finds a piece of content.

On the old IIS 5.0 server these URLs both work, serving up the document named “foo bar.pdf”:

http://server/foo+bar.pdf

http://server/foo%20bar.pdf

On the new IIS 7 (Windows 2008) server, the second URL works but the first one gives an error.

Solution:

I put this in my application’s web.config file:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <system.webServer>
    <security>
      <requestFiltering allowDoubleEscaping="True" />
    </security>
    <rewrite>
      <rules>
        <rule name="RewriteUserFriendlyURL1" stopProcessing="false">
          <match url="\+" />
          <conditions>
            <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
            <add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
          </conditions>
          <action type="Rewrite" url="{UrlDecode:{REQUEST_URI}}" />
        </rule>
      </rules>
    </rewrite>
  </system.webServer>
</configuration>

the allowDoubleEscaping directive on line 5 solves the first part of the problem, allowing IIS to handle unescaped plusses. The rewrite rule below passes the requested URI through the UrlDecode function (line 15), which thankfully still remembers the time-tested convention of plus equaling space. Now both forms of the URL work.

(I didn’t really write the rewrite stanza, I just stumbled around with the rewrite URL editor in the IIS Manager until it worked)

Yay!

I like using Subversion to deploy web content to production servers. I check in everything while I’m working on the development copy, then check out onto the server when it’s ready.

Subversion creates a .svn directory contain readable copies of all your files, which is bad for server-processed files like .php or .aspx that you don’t want readable by, say, Google Hackers.

I have thought about this before but when I went to do it I couldn’t find any clear guides online. I did find this question at Server Fault, which is a newish sister of Stack Overflow, which reminds me kind of Experts Exchange but without the suck. Except that in this case the answers sucked. So I figured it out and added my answer and am posting it here too:

“Don’t do it that way” does not answer the question.

Practically, I like having a working copy on the production server, because that way I can make quick changes in production (who has never done that?) and check them back in. It depends on where you want your security/convenience slider, and in many cases this is a good place.

The standard solution in Apacheland is to leave the .svn files there but tell the web server to never serve them. Here’s how to do that with IIS 5 through 7 on Windows NT4 through 2008.

1. Download and install ISAPI_Rewrite — the Lite version will be enough for this purpose. There are two versions, version 2 and 3. Use ISAPI_Rewrite3 unless you need to support NT4. Also, note the extra IIS features you need to enable for Win 2008.
   Warning– the MSI installer may stop and start IIS.

2. Launch the Helicon->ISAPI_Rewrite3->ISAPI_Rewrite Manager app from the Start Menu. It makes editing the config file (installed in C:\Program Files\Helicon\ISAPI_Rewrite3\httpd.conf by default) easier, but you can also do it by hand. note, the config file in ISAPI_Rewrite2 is named httpd.ini and is read-only by default.

3. Add these lines to httpd.conf:

# Deny access to Subversion working copy administrative
#  directories (.svn) and their contents
RewriteRule .*/\.svn\b.* . [F,I,O]

Now, any request for a .svn directory or its contents will result in a 404 Not Found from the server.

Problem

I work with PHP on a bunch of different web servers. In this case I needed to resize photos (JPEGs) from Microsoft SQL Server (MSSQL) blobs on a Windows web server running IIS. I got stuff working on my local Windows development machine (under Apache, XAMPP rocks BTW), but when I moved to the production server:

• the script would silently fail with a 500 error whenever I called a GD function, specifically imagecreatefromstring()
• The most common IIS and GD error appears to be when PHP can’t find the GD DLL at all, which produces a nice message like

  Fatal error: Call to undefined function: imagecreatefromstring() in c:\inetpub\wwwroot\test2.php on line 7 PHP Warning: Unable to load dynamic library ‘c:\php\ext\php_gd2.dll’ – The specified procedure could not be found. in Unknown on line 0

  This was NOT my problem. My script kept failing silently, with no output after I called the first GD function.
• IIS has no real error log like Apache. When my script silently failed, nothing was logged in the Application Event log, PHP’s error.log or the pathetic c:\WINDOWS\system32\LogFiles\HTTPERR\httperr*.log. Googling hard, I found I might have luck looking for “Worker Process Recycling Events”, which is apparently Microsoft’s IIS term for that confusing word “error”, but I didn’t go far down that path.
• Running my script from the command line using PHP didn’t produce any visible error either

IIS sucks. Apache’s error log is way better.

Solutions

I had to do both these things:

• Copy the php_gd2.dll to C:\WINDOWS\system32. Ridiculous, but I have had to do it before with other PHP modules to have them really work. After I did that, the script would work for small JPEG images.
• Increase the memory_limit in php.ini from 16MB to 32MB, so any whole high-res JPEG from the database will fit uncompressed in PHP’s memory