I don't like that argument (and I didn't see it from Dan) - it's very
Unix-centric, and doesn't generalize. After all, if you can't use some
string in a URL because it MAY get a 403 response, then I can add a
single line to my server config that would imply you shouldn't use any
text string in a URL.
What behavior did Dan (or you) recommend if I type in a URL with a
"../" in it by hand? Not doing what the user asked you to to avoid
vague security problems on someone else's machine is pretty clearly
broken. Escaping the URL is acceptable, and might even produce the
correct results.
<mike