URI. In this case, it finds the space and thinks it has found the end of the URI, but this is incorrect. Could this be fixed by changing the rule to use %20 or |20| instead of " "? I tried doing exactly that, but I still did not get the alert, but this may be caused by the fact that I may not be using the correct http decode options. Alain.