diff --git a/jsts/jst_prefix.js b/jsts/jst_prefix.js
index 8f3a778..9cb4c7e 100644
--- a/jsts/jst_prefix.js
+++ b/jsts/jst_prefix.js
@@ -93,7 +93,7 @@ function session_start()
 {
   if($_jst_session)
     return;
-  if($_val_input == 1) 
+  if($_val_input == 1)
   {
     $_val_input = 0;
     return;
@@ -186,11 +186,11 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
     {
@@ -212,17 +212,17 @@ if(filesData)
     var fileId = null;
     for(var j = 0; j < fileData.length; ++j)
     {
-      var fileValue = fileData[j].split('=');
-      if(fileValue.length == 2)
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
       {
         if(!fileId)
         {
-          fileId = decodeURIComponent(fileValue[1]);
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
           $_FILES[fileId]={};
         }
         else
         {
-          $_FILES[fileId][decodeURIComponent(fileValue[0])]=decodeURIComponent(fileValue[1]);
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
         }
       }
       else
@@ -241,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
diff --git a/source/jst_parser.c b/source/jst_parser.c
index c3cce5c..8d09ec1 100644
--- a/source/jst_parser.c
+++ b/source/jst_parser.c
@@ -760,7 +760,7 @@ static int template_process(char** buf, size_t* buflen, int top)
   char filepath[MAX_PATH_LEN];
   growing_buffer tbuf1;
   growing_buffer tbuf2;
-  char TEMPL_PATH[MAX_PATH_LEN] = "/usr/video_analytics/";
+  char TEMPL_PATH[MAX_PATH_LEN] = "/var/video_analytics/";
   buffer_init(&tbuf1);
   buffer_init(&tbuf2);
 
diff --git a/tests/parser/jst_parser_backslash.jst.parsed b/tests/parser/jst_parser_backslash.jst.parsed
index b695eb3..a170d01 100644
--- a/tests/parser/jst_parser_backslash.jst.parsed
+++ b/tests/parser/jst_parser_backslash.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -157,6 +257,12 @@ function include($filepath)
 
 /* begin application code */
 
+
+
+
+
+
+
 echo('a \\ b\n\
 ');
 /* end application code */
diff --git a/tests/parser/jst_parser_comment_tag.jst.parsed b/tests/parser/jst_parser_comment_tag.jst.parsed
index a721fbf..5e3803d 100644
--- a/tests/parser/jst_parser_comment_tag.jst.parsed
+++ b/tests/parser/jst_parser_comment_tag.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -157,6 +257,12 @@ function include($filepath)
 
 /* begin application code */
 
+
+
+
+
+
+
 echo('/*\n\
 ');
 echo("This cannot be commented out");
diff --git a/tests/parser/jst_parser_include_code_after.jst.parsed b/tests/parser/jst_parser_include_code_after.jst.parsed
index cf2e250..0aab6bb 100644
--- a/tests/parser/jst_parser_include_code_after.jst.parsed
+++ b/tests/parser/jst_parser_include_code_after.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -159,6 +259,12 @@ function include($filepath)
 
 
 
+
+
+
+
+
+
 echo("should appear only once");
 
 THIS SHOULD APPEAR AFTER THE INCLUDE
diff --git a/tests/parser/jst_parser_include_code_before.jst.parsed b/tests/parser/jst_parser_include_code_before.jst.parsed
index fbf5b75..086865b 100644
--- a/tests/parser/jst_parser_include_code_before.jst.parsed
+++ b/tests/parser/jst_parser_include_code_before.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -158,6 +258,12 @@ function include($filepath)
 /* begin application code */
 
 
+
+
+
+
+
+
 THIS SHOULD APPEAR BEFORE THE INCLUDE
 
 echo("should appear only once");
diff --git a/tests/parser/jst_parser_include_malformed_1.jst.parsed b/tests/parser/jst_parser_include_malformed_1.jst.parsed
index 36ea207..755f733 100644
--- a/tests/parser/jst_parser_include_malformed_1.jst.parsed
+++ b/tests/parser/jst_parser_include_malformed_1.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -158,6 +258,12 @@ function include($filepath)
 /* begin application code */
 
 
+
+
+
+
+
+
 include( x "include/once.jst");
 
 /* end application code */
diff --git a/tests/parser/jst_parser_include_nested.jst.parsed b/tests/parser/jst_parser_include_nested.jst.parsed
index 1f2b01e..1a74235 100644
--- a/tests/parser/jst_parser_include_nested.jst.parsed
+++ b/tests/parser/jst_parser_include_nested.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -158,6 +258,12 @@ function include($filepath)
 /* begin application code */
 
 
+
+
+
+
+
+
   
   
   
diff --git a/tests/parser/jst_parser_include_not_if_in_block_comment.jst.parsed b/tests/parser/jst_parser_include_not_if_in_block_comment.jst.parsed
index b7b8b2f..4a1e440 100644
--- a/tests/parser/jst_parser_include_not_if_in_block_comment.jst.parsed
+++ b/tests/parser/jst_parser_include_not_if_in_block_comment.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -158,6 +258,12 @@ function include($filepath)
 /* begin application code */
 
 
+
+
+
+
+
+
 /*include("include/once.jst");*/
 /*
 include("include/once.jst");
diff --git a/tests/parser/jst_parser_include_not_if_in_content.jst.parsed b/tests/parser/jst_parser_include_not_if_in_content.jst.parsed
index 6623d64..f308759 100644
--- a/tests/parser/jst_parser_include_not_if_in_content.jst.parsed
+++ b/tests/parser/jst_parser_include_not_if_in_content.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -157,6 +257,12 @@ function include($filepath)
 
 /* begin application code */
 
+
+
+
+
+
+
 echo('//FIXME: if i remove this comment, then the following line doesn\'t output\n\
 include("include/once.jst");\n\
 \n\
diff --git a/tests/parser/jst_parser_include_not_if_in_line_comment.jst.parsed b/tests/parser/jst_parser_include_not_if_in_line_comment.jst.parsed
index 0611a2c..3d79a63 100644
--- a/tests/parser/jst_parser_include_not_if_in_line_comment.jst.parsed
+++ b/tests/parser/jst_parser_include_not_if_in_line_comment.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -158,6 +258,12 @@ function include($filepath)
 /* begin application code */
 
 
+
+
+
+
+
+
 //include("includes/once.jst");
 //blah include("include/once.jst");
 //include("include/once.jst"); blah
diff --git a/tests/parser/jst_parser_include_once.jst.parsed b/tests/parser/jst_parser_include_once.jst.parsed
index e3167dc..86d4af8 100644
--- a/tests/parser/jst_parser_include_once.jst.parsed
+++ b/tests/parser/jst_parser_include_once.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -159,6 +259,12 @@ function include($filepath)
 
 
 
+
+
+
+
+
+
 echo("should appear only once");
 
 
diff --git a/tests/parser/jst_parser_include_runtime.jst.parsed b/tests/parser/jst_parser_include_runtime.jst.parsed
index 5901de6..04cd449 100644
--- a/tests/parser/jst_parser_include_runtime.jst.parsed
+++ b/tests/parser/jst_parser_include_runtime.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -159,6 +259,12 @@ function include($filepath)
 
 
 
+
+
+
+
+
+
 //jst parser should skip all these and copy into output verbatim
 
 var path1 = "include/once.jst"
diff --git a/tests/parser/jst_parser_include_unknown.jst.parsed b/tests/parser/jst_parser_include_unknown.jst.parsed
index bdaffe7..9588236 100644
--- a/tests/parser/jst_parser_include_unknown.jst.parsed
+++ b/tests/parser/jst_parser_include_unknown.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -159,6 +259,12 @@ function include($filepath)
 
 
 
+
+
+
+
+
+
 //jst parser should skip all these and copy into output verbatim
 
 include("path1');
diff --git a/tests/parser/jst_parser_line_feeds.jst.parsed b/tests/parser/jst_parser_line_feeds.jst.parsed
index 5865d89..4a7d0bd 100644
--- a/tests/parser/jst_parser_line_feeds.jst.parsed
+++ b/tests/parser/jst_parser_line_feeds.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -157,6 +257,12 @@ function include($filepath)
 
 /* begin application code */
 
+
+
+
+
+
+
 echo('a\n\
 \n\
 b\n\
diff --git a/tests/parser/jst_parser_single_quotes.jst.parsed b/tests/parser/jst_parser_single_quotes.jst.parsed
index c4013f8..cfa5ad8 100644
--- a/tests/parser/jst_parser_single_quotes.jst.parsed
+++ b/tests/parser/jst_parser_single_quotes.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -157,6 +257,12 @@ function include($filepath)
 
 /* begin application code */
 
+
+
+
+
+
+
 echo('\'a b c\'\n\
 ');
 /* end application code */
diff --git a/tests/parser/jst_parser_skip_whitespace.jst.parsed b/tests/parser/jst_parser_skip_whitespace.jst.parsed
index 8269b12..16608ca 100644
--- a/tests/parser/jst_parser_skip_whitespace.jst.parsed
+++ b/tests/parser/jst_parser_skip_whitespace.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -157,6 +257,12 @@ function include($filepath)
 
 /* begin application code */
 
+
+
+
+
+
+
 echo('begin content\n\
 ');echo('\n\
 end content\n\
diff --git a/tests/parser/jst_parser_template_block_content.jst.parsed b/tests/parser/jst_parser_template_block_content.jst.parsed
index 292d504..dfebe64 100644
--- a/tests/parser/jst_parser_template_block_content.jst.parsed
+++ b/tests/parser/jst_parser_template_block_content.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -157,6 +257,12 @@ function include($filepath)
 
 /* begin application code */
 
+
+
+
+
+
+
  echo("Hello World"); 
 /* end application code */
 exit(0);
diff --git a/tests/parser/jst_parser_template_block_string.jst.parsed b/tests/parser/jst_parser_template_block_string.jst.parsed
index 9238bf5..de6c592 100644
--- a/tests/parser/jst_parser_template_block_string.jst.parsed
+++ b/tests/parser/jst_parser_template_block_string.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -158,6 +258,12 @@ function include($filepath)
 /* begin application code */
 
 
+
+
+
+
+
+
   var world="World";
 echo('\n\
 Hello ');echo(world);echo('!\n\
diff --git a/tests/parser/jst_prefix.js b/tests/parser/jst_prefix.js
index 41386b4..9cb4c7e 100644
--- a/tests/parser/jst_prefix.js
+++ b/tests/parser/jst_prefix.js
@@ -16,23 +16,30 @@
  See the License for the specific language governing permissions and
  limitations under the License.
 */
-
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -41,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -48,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -80,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -139,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -160,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;