Yesterday I ran into an interesting quirk involving the Flash Player 8 while doing some freelance work. It deals with creating a mailto link in Flash that includes a subject line and testing it locally.

All the client needed was a simple link that would open up the user's email program and insert the proper email address and subject line. So as I've always done, I created a button and added the following code:

on(release) {
	getURL("mailto:email@address.net?subject=Test");
}

Nothing fancy there, just your most basic way to send an email with a subject line. I test it out in my browser like usual... Outlook opens up a "New Message" window... "To:" address is prepopulated, but the "Subject:" line is blank. Didn't expect that to happen.

So I thought maybe Flash was stripping out the "?" and everything after it for some reason. To test my theory, I try linking to Google and adding "?testing" to the end of the URL, like so:

on(release) {
	getURL("http://www.google.com/?testing");
}

When I click that link, the following message box appears:

That reminded me about the new Flash Player 8 security changes and how local content cannot access remote files. I wasn't sure if that was related to my problem, so I clicked "Settings..." and I was brought to the Flash Player Settings Manager page.

It was the first time I'd come across the Settings Manager, and I was surprised to see the Advanced Settings are actually set in special Flash movie you access from a webpage on Macromedia's website. If you haven't seen it yet, here's a screenshot:

Note: The Settings Manager that you see above is an image; it is not the actual Settings Manager itself.

The obvious next step here was to edit my locations of trusted local content. So I clicked the "Edit locations..." dropdown, selected "Add Location," and I was presented with this:

Bravo Macromedia! I applaud your work on this. The path I needed to add was listed right there for me to copy and paste. So I copy and paste the directory (I didn't include the file, because I want to trust the entire directory) and click "Confirm."

The path is now displayed as a trusted location:

So I close the browser and reopen my test page. I click the link and I am successfully brought to http://www.google.com/?testing. Great. Now time to test if this affects my "mailto" link. So I change the getURL url back to "mailto:email@address.net?subject=Test" and give it a shot. I click the link, and Outlook opens with both the "To:" and "Subject:" fields prepopulated as I wish. Woohoo!

This is of course leading me to believe that when run locally, the Flash Player 8 does strip out the question mark and everything after it in the url, but does not alert the user, unless you make the security setting change that I did. To be 100% sure of my theory, I change the link to the following:

on(release) {
	getURL("index.html?testing");
}

I create a quick default index.html file locally and give it a test run. I click the link and... I'm only brought to index.html... no "?testing" at the end of it. Not what I expected. I tried using "GET" as well and that didn't work:

on(release) {
	getURL("index.html?testing","","GET");
}

So what have I learned from all of this? It appears that when run locally, Flash Player 8 will always strip the question mark and anything following it off the end of the url of the getURL function, regardless of security settings. However, if the url in the getURL function is a mailto link AND your security settings are set to trust your local location, it will prepopulated the values as you wish.

Of course, when the file is uploaded to the internet this isn't an issue, but if you test your work locally first, this knowledge will hopefully save you some headaches.

Add this to your del.icio.us bookmarks