From c87dc71ad567c6082757944f40f533afd928c4fd Mon Sep 17 00:00:00 2001
From: Pavan Kumar Reddy Balireddy <pavankumarreddy_balireddy@comcast.com>
Date: Wed, 16 Sep 2026 17:40:10 +0530
Subject: [PATCH] RDKB-66901 : Updated parsers in GET, POST, and file metadata

---
 jsts/jst_prefix.js                            |  24 ++--
 tests/CMakeLists.txt                          |   2 +
 tests/parser/jst_parser_backslash.jst.parsed  | 134 ++++++++++++++++--
 .../parser/jst_parser_comment_tag.jst.parsed  | 134 ++++++++++++++++--
 .../jst_parser_include_code_after.jst.parsed  | 134 ++++++++++++++++--
 .../jst_parser_include_code_before.jst.parsed | 134 ++++++++++++++++--
 .../jst_parser_include_malformed_1.jst.parsed | 134 ++++++++++++++++--
 .../jst_parser_include_nested.jst.parsed      | 134 ++++++++++++++++--
 ...include_not_if_in_block_comment.jst.parsed | 134 ++++++++++++++++--
 ...arser_include_not_if_in_content.jst.parsed | 134 ++++++++++++++++--
 ..._include_not_if_in_line_comment.jst.parsed | 134 ++++++++++++++++--
 .../parser/jst_parser_include_once.jst.parsed | 134 ++++++++++++++++--
 .../jst_parser_include_runtime.jst.parsed     | 134 ++++++++++++++++--
 .../jst_parser_include_unknown.jst.parsed     | 134 ++++++++++++++++--
 tests/parser/jst_parser_line_feeds.jst.parsed | 134 ++++++++++++++++--
 .../jst_parser_single_quotes.jst.parsed       | 134 ++++++++++++++++--
 .../jst_parser_skip_whitespace.jst.parsed     | 134 ++++++++++++++++--
 ...t_parser_template_block_content.jst.parsed | 134 ++++++++++++++++--
 ...st_parser_template_block_string.jst.parsed | 134 ++++++++++++++++--
 tests/parser/jst_prefix.js                    | 113 ++++++++++++---
 tests/parser_test.cpp                         |  90 ++++++++++++
 21 files changed, 2224 insertions(+), 283 deletions(-)

diff --git a/jsts/jst_prefix.js b/jsts/jst_prefix.js
index 8f3a778..9cb4c7e 100644
--- a/jsts/jst_prefix.js
+++ b/jsts/jst_prefix.js
@@ -93,7 +93,7 @@ function session_start()
 {
   if($_jst_session)
     return;
-  if($_val_input == 1) 
+  if($_val_input == 1)
   {
     $_val_input = 0;
     return;
@@ -186,11 +186,11 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
     {
@@ -212,17 +212,17 @@ if(filesData)
     var fileId = null;
     for(var j = 0; j < fileData.length; ++j)
     {
-      var fileValue = fileData[j].split('=');
-      if(fileValue.length == 2)
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
       {
         if(!fileId)
         {
-          fileId = decodeURIComponent(fileValue[1]);
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
           $_FILES[fileId]={};
         }
         else
         {
-          $_FILES[fileId][decodeURIComponent(fileValue[0])]=decodeURIComponent(fileValue[1]);
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
         }
       }
       else
@@ -241,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index baa60e7..f982969 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -77,6 +77,8 @@ add_executable(
   ../source/jst_session.c
   ../source/jst_internal.c
   ../source/duktape/duktape.c)
+target_compile_definitions(parser_test PRIVATE
+  JST_PREFIX_PATH=\"${CMAKE_SOURCE_DIR}/jsts/jst_prefix.js\")
 target_link_libraries(parser_test libgtest libgmock -pthread)
 install(DIRECTORY parser DESTINATION ${CMAKE_CURRENT_BINARY_DIR})
 
diff --git a/tests/parser/jst_parser_backslash.jst.parsed b/tests/parser/jst_parser_backslash.jst.parsed
index b695eb3..fc2dd28 100644
--- a/tests/parser/jst_parser_backslash.jst.parsed
+++ b/tests/parser/jst_parser_backslash.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -157,6 +257,10 @@ function include($filepath)
 
 /* begin application code */
 
+
+
+
+
 echo('a \\ b\n\
 ');
 /* end application code */
diff --git a/tests/parser/jst_parser_comment_tag.jst.parsed b/tests/parser/jst_parser_comment_tag.jst.parsed
index a721fbf..0fad3cf 100644
--- a/tests/parser/jst_parser_comment_tag.jst.parsed
+++ b/tests/parser/jst_parser_comment_tag.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -157,6 +257,10 @@ function include($filepath)
 
 /* begin application code */
 
+
+
+
+
 echo('/*\n\
 ');
 echo("This cannot be commented out");
diff --git a/tests/parser/jst_parser_include_code_after.jst.parsed b/tests/parser/jst_parser_include_code_after.jst.parsed
index cf2e250..33ec800 100644
--- a/tests/parser/jst_parser_include_code_after.jst.parsed
+++ b/tests/parser/jst_parser_include_code_after.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -159,6 +259,10 @@ function include($filepath)
 
 
 
+
+
+
+
 echo("should appear only once");
 
 THIS SHOULD APPEAR AFTER THE INCLUDE
diff --git a/tests/parser/jst_parser_include_code_before.jst.parsed b/tests/parser/jst_parser_include_code_before.jst.parsed
index fbf5b75..3e4de53 100644
--- a/tests/parser/jst_parser_include_code_before.jst.parsed
+++ b/tests/parser/jst_parser_include_code_before.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -158,6 +258,10 @@ function include($filepath)
 /* begin application code */
 
 
+
+
+
+
 THIS SHOULD APPEAR BEFORE THE INCLUDE
 
 echo("should appear only once");
diff --git a/tests/parser/jst_parser_include_malformed_1.jst.parsed b/tests/parser/jst_parser_include_malformed_1.jst.parsed
index 36ea207..ad22fde 100644
--- a/tests/parser/jst_parser_include_malformed_1.jst.parsed
+++ b/tests/parser/jst_parser_include_malformed_1.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -158,6 +258,10 @@ function include($filepath)
 /* begin application code */
 
 
+
+
+
+
 include( x "include/once.jst");
 
 /* end application code */
diff --git a/tests/parser/jst_parser_include_nested.jst.parsed b/tests/parser/jst_parser_include_nested.jst.parsed
index 1f2b01e..b3cf673 100644
--- a/tests/parser/jst_parser_include_nested.jst.parsed
+++ b/tests/parser/jst_parser_include_nested.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -158,6 +258,10 @@ function include($filepath)
 /* begin application code */
 
 
+
+
+
+
   
   
   
diff --git a/tests/parser/jst_parser_include_not_if_in_block_comment.jst.parsed b/tests/parser/jst_parser_include_not_if_in_block_comment.jst.parsed
index b7b8b2f..95b996f 100644
--- a/tests/parser/jst_parser_include_not_if_in_block_comment.jst.parsed
+++ b/tests/parser/jst_parser_include_not_if_in_block_comment.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -158,6 +258,10 @@ function include($filepath)
 /* begin application code */
 
 
+
+
+
+
 /*include("include/once.jst");*/
 /*
 include("include/once.jst");
diff --git a/tests/parser/jst_parser_include_not_if_in_content.jst.parsed b/tests/parser/jst_parser_include_not_if_in_content.jst.parsed
index 6623d64..cee021d 100644
--- a/tests/parser/jst_parser_include_not_if_in_content.jst.parsed
+++ b/tests/parser/jst_parser_include_not_if_in_content.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -157,6 +257,10 @@ function include($filepath)
 
 /* begin application code */
 
+
+
+
+
 echo('//FIXME: if i remove this comment, then the following line doesn\'t output\n\
 include("include/once.jst");\n\
 \n\
diff --git a/tests/parser/jst_parser_include_not_if_in_line_comment.jst.parsed b/tests/parser/jst_parser_include_not_if_in_line_comment.jst.parsed
index 0611a2c..2d4835b 100644
--- a/tests/parser/jst_parser_include_not_if_in_line_comment.jst.parsed
+++ b/tests/parser/jst_parser_include_not_if_in_line_comment.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -158,6 +258,10 @@ function include($filepath)
 /* begin application code */
 
 
+
+
+
+
 //include("includes/once.jst");
 //blah include("include/once.jst");
 //include("include/once.jst"); blah
diff --git a/tests/parser/jst_parser_include_once.jst.parsed b/tests/parser/jst_parser_include_once.jst.parsed
index e3167dc..443bc7c 100644
--- a/tests/parser/jst_parser_include_once.jst.parsed
+++ b/tests/parser/jst_parser_include_once.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -159,6 +259,10 @@ function include($filepath)
 
 
 
+
+
+
+
 echo("should appear only once");
 
 
diff --git a/tests/parser/jst_parser_include_runtime.jst.parsed b/tests/parser/jst_parser_include_runtime.jst.parsed
index 5901de6..17f7062 100644
--- a/tests/parser/jst_parser_include_runtime.jst.parsed
+++ b/tests/parser/jst_parser_include_runtime.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -159,6 +259,10 @@ function include($filepath)
 
 
 
+
+
+
+
 //jst parser should skip all these and copy into output verbatim
 
 var path1 = "include/once.jst"
diff --git a/tests/parser/jst_parser_include_unknown.jst.parsed b/tests/parser/jst_parser_include_unknown.jst.parsed
index bdaffe7..0b758f7 100644
--- a/tests/parser/jst_parser_include_unknown.jst.parsed
+++ b/tests/parser/jst_parser_include_unknown.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -159,6 +259,10 @@ function include($filepath)
 
 
 
+
+
+
+
 //jst parser should skip all these and copy into output verbatim
 
 include("path1');
diff --git a/tests/parser/jst_parser_line_feeds.jst.parsed b/tests/parser/jst_parser_line_feeds.jst.parsed
index 5865d89..0551ae0 100644
--- a/tests/parser/jst_parser_line_feeds.jst.parsed
+++ b/tests/parser/jst_parser_line_feeds.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -157,6 +257,10 @@ function include($filepath)
 
 /* begin application code */
 
+
+
+
+
 echo('a\n\
 \n\
 b\n\
diff --git a/tests/parser/jst_parser_single_quotes.jst.parsed b/tests/parser/jst_parser_single_quotes.jst.parsed
index c4013f8..5434d13 100644
--- a/tests/parser/jst_parser_single_quotes.jst.parsed
+++ b/tests/parser/jst_parser_single_quotes.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -157,6 +257,10 @@ function include($filepath)
 
 /* begin application code */
 
+
+
+
+
 echo('\'a b c\'\n\
 ');
 /* end application code */
diff --git a/tests/parser/jst_parser_skip_whitespace.jst.parsed b/tests/parser/jst_parser_skip_whitespace.jst.parsed
index 8269b12..e8ad090 100644
--- a/tests/parser/jst_parser_skip_whitespace.jst.parsed
+++ b/tests/parser/jst_parser_skip_whitespace.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -157,6 +257,10 @@ function include($filepath)
 
 /* begin application code */
 
+
+
+
+
 echo('begin content\n\
 ');echo('\n\
 end content\n\
diff --git a/tests/parser/jst_parser_template_block_content.jst.parsed b/tests/parser/jst_parser_template_block_content.jst.parsed
index 292d504..02fcf83 100644
--- a/tests/parser/jst_parser_template_block_content.jst.parsed
+++ b/tests/parser/jst_parser_template_block_content.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -157,6 +257,10 @@ function include($filepath)
 
 /* begin application code */
 
+
+
+
+
  echo("Hello World"); 
 /* end application code */
 exit(0);
diff --git a/tests/parser/jst_parser_template_block_string.jst.parsed b/tests/parser/jst_parser_template_block_string.jst.parsed
index 9238bf5..6c50af4 100644
--- a/tests/parser/jst_parser_template_block_string.jst.parsed
+++ b/tests/parser/jst_parser_template_block_string.jst.parsed
@@ -1,19 +1,45 @@
+/*
+ If not stated otherwise in this file or this component's Licenses.txt file the
+ following copyright and licenses apply:
+
+ Copyright 2018 RDK Management
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -22,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -29,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -61,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -120,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -141,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
@@ -158,6 +258,10 @@ function include($filepath)
 /* begin application code */
 
 
+
+
+
+
   var world="World";
 echo('\n\
 Hello ');echo(world);echo('!\n\
diff --git a/tests/parser/jst_prefix.js b/tests/parser/jst_prefix.js
index 41386b4..9cb4c7e 100644
--- a/tests/parser/jst_prefix.js
+++ b/tests/parser/jst_prefix.js
@@ -16,23 +16,30 @@
  See the License for the specific language governing permissions and
  limitations under the License.
 */
-
 try
 {
 /* HEADERS: accumulate headers into a buffer
             to send to stdout in _jst_finish*/
-_jst_header_buffer = "Content-type: text/html";
+_jst_header_content_type_set = false;
+_jst_header_buffer = "";
 function header(str)
 {
-  if(str.toLowerCase().indexOf('location:') == 0)
+  lstr = str.toLowerCase();
+  if(lstr.indexOf('location:') == 0)
   {
     _jst_header_buffer = "HTTP/1.0 302 Ok\r\n";
     _jst_header_buffer += "Status: 302 Moved\r\n";
-    _jst_header_buffer += str;
+    _jst_header_buffer += str + "\r\n";
   }
   else
   {
-    _jst_header_buffer += "\n" + str;
+    if(lstr.indexOf('content-type:') == 0)
+    {
+      _jst_header_content_type_set = true;
+      if(lstr.indexOf('application/json') != -1)
+        _jst_header_buffer += "Content-Type: text/html\r\n";
+    }
+    _jst_header_buffer += str + "\r\n";
   }
 }
 
@@ -41,6 +48,7 @@ function header(str)
 _jst_echo_buffer = "";
 function echo(str)
 {
+   str = (typeof(str)!="undefined") ? str : "";
   _jst_echo_buffer += str;
 }
 
@@ -48,9 +56,9 @@ function echo(str)
            and it will send the headers and content to stdout */
 function _jst_finish()
 {
-  print(_jst_header_buffer);
-  print("\r\n\r\n\n");
-  print(_jst_echo_buffer);
+  if(!_jst_header_content_type_set)
+    print("Content-type: text/html\r");
+  print(_jst_header_buffer + "\r\n" + _jst_echo_buffer);
 }
 
 /* EXIT: there is no way to simply quit in the middle of a script, so
@@ -80,12 +88,51 @@ var $_SERVER = new Proxy({}, {
 /* SESSION: session data set by web app, saved to disk, and referenced by session id stored in cookie */
 var $_SESSION = {};
 var $_jst_session = null;
+var $_val_input = {};
 function session_start()
 {
   if($_jst_session)
     return;
+  if($_val_input == 1)
+  {
+    $_val_input = 0;
+    return;
+  }
   ccsp_session.start();
-  header("Set-Cookie: DUKSID=" + ccsp_session.getId() + ";");
+  var host = getenv('HTTPS');
+  if (host == false)
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
+  $_jst_session = ccsp_session.getData();
+  $_SESSION = new Proxy($_jst_session, {
+    get: function(obj, prop) {
+      return obj[prop];
+    },
+    set: function(obj, prop, val){
+      obj[prop] = val;
+      ccsp_session.setData(obj);
+      return true;
+    },
+    deleteProperty(obj, prop) {
+      if(prop in obj)
+      {
+        delete obj[prop];
+        ccsp_session.setData(obj);
+      }
+      return true;
+    }
+  });
+}
+function session_create(){
+  ccsp_session.create();
+  var host = getenv('HTTPS');
+  if (host == false)
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
+  else
+    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
+  header($cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -139,14 +186,48 @@ if(postData)
   var postValues = postData.split('&');
   for(var i = 0; i < postValues.length; ++i)
   {
-    var postValue = postValues[i].split('=');
-    if(postValue.length == 2)
+    var eqIdx = postValues[i].indexOf('=');
+    if(eqIdx != -1)
     {
-      var value = postValue[1].replace(/[+]/g," ");
-      $_POST[postValue[0]] = decodeURIComponent(value);
+      var value = postValues[i].substring(eqIdx + 1).replace(/[+]/g," ");
+      $_POST[postValues[i].substring(0, eqIdx)] = decodeURIComponent(value);
     }
     else
+    {
       print("unexpected post data");
+      $_val_input = 1;
+    }
+  }
+}
+
+/* FILES: multipart/form-data files via stdin */
+$_FILES={};
+var filesData = ccsp_post.getFiles();
+if(filesData)
+{
+  var fileList = filesData.split(';');
+  for(var i = 0; i < fileList.length; ++i)
+  {
+    var fileData = fileList[i].split('&');
+    var fileId = null;
+    for(var j = 0; j < fileData.length; ++j)
+    {
+      var eqIdx = fileData[j].indexOf('=');
+      if(eqIdx != -1)
+      {
+        if(!fileId)
+        {
+          fileId = decodeURIComponent(fileData[j].substring(eqIdx + 1));
+          $_FILES[fileId]={};
+        }
+        else
+        {
+          $_FILES[fileId][decodeURIComponent(fileData[j].substring(0, eqIdx))]=decodeURIComponent(fileData[j].substring(eqIdx + 1));
+        }
+      }
+      else
+        print("unexpected file data");
+    }
   }
 }
 
@@ -160,10 +241,10 @@ $_GET= (function ()
     var ar = qs.split('&');
     for(var i=0; i<ar.length; ++i)
     {
-      var ar2 = ar[i].split('=');
-      if(ar2.length != 2)
+      var eqIdx = ar[i].indexOf('=');
+      if(eqIdx == -1)
         throw Error("$_GET: Invalid QUERY_STRING");
-      out[ar2[0]] = ar2[1];
+      out[ar[i].substring(0, eqIdx)] = ar[i].substring(eqIdx + 1);
     }
   }
   return out;
diff --git a/tests/parser_test.cpp b/tests/parser_test.cpp
index d7eb028..75b2375 100644
--- a/tests/parser_test.cpp
+++ b/tests/parser_test.cpp
@@ -154,6 +154,79 @@ static string getFieldValue(const string& input, const string& key)
   return input.substr(start, end - start);
 }
 
+static duk_ret_t test_getenv(duk_context* ctx)
+{
+  const char* name = duk_require_string(ctx, 0);
+  const char* value = getenv(name);
+
+  if(value)
+    duk_push_string(ctx, value);
+  else
+    duk_push_false(ctx);
+
+  return 1;
+}
+
+static duk_ret_t test_post_data(duk_context* ctx)
+{
+  duk_get_global_string(ctx, "__test_post_data");
+  return 1;
+}
+
+static duk_ret_t test_files_data(duk_context* ctx)
+{
+  duk_get_global_string(ctx, "__test_files_data");
+  return 1;
+}
+
+static void evaluatePrefixWithRequestData(duk_context* ctx,
+                                          const char* post_data,
+                                          const char* files_data)
+{
+  duk_push_c_function(ctx, ccsp_session_module_open, 0);
+  ASSERT_EQ(duk_pcall(ctx, 0), DUK_EXEC_SUCCESS);
+  duk_put_global_string(ctx, "ccsp_session");
+
+  duk_push_object(ctx);
+  duk_push_c_function(ctx, test_getenv, 1);
+  duk_put_prop_string(ctx, -2, "getenv");
+  duk_put_global_string(ctx, "ccsp");
+
+  duk_push_string(ctx, post_data);
+  duk_put_global_string(ctx, "__test_post_data");
+  duk_push_string(ctx, files_data);
+  duk_put_global_string(ctx, "__test_files_data");
+
+  duk_push_object(ctx);
+  duk_push_c_function(ctx, test_post_data, 0);
+  duk_put_prop_string(ctx, -2, "getPost");
+  duk_push_c_function(ctx, test_files_data, 0);
+  duk_put_prop_string(ctx, -2, "getFiles");
+  duk_put_global_string(ctx, "ccsp_post");
+
+  std::ifstream prefix_file(JST_PREFIX_PATH);
+  ASSERT_TRUE(prefix_file.is_open());
+  std::string prefix((std::istreambuf_iterator<char>(prefix_file)),
+                     std::istreambuf_iterator<char>());
+  prefix += "\n} catch (e) { throw e; }\n";
+  ASSERT_EQ(duk_peval_lstring(ctx, prefix.c_str(), prefix.length()), DUK_EXEC_SUCCESS)
+      << duk_safe_to_string(ctx, -1);
+  duk_pop(ctx);
+}
+
+static bool evaluateJavaScriptBoolean(duk_context* ctx, const char* source)
+{
+  if(duk_peval_string(ctx, source) != DUK_EXEC_SUCCESS)
+  {
+    duk_pop(ctx);
+    return false;
+  }
+
+  const bool result = duk_get_boolean(ctx, -1);
+  duk_pop(ctx);
+  return result;
+}
+
 int recurseDirectory(const string& path, vector<string>& files, const string& match)
 {
   DIR *dir;
@@ -219,6 +292,23 @@ TEST(general, parser) {
   }
 }
 
+TEST(general, prefix_preserves_equals_signs_in_request_values)
+{
+  EnvVarGuard query_string_guard("QUERY_STRING");
+  query_string_guard.set("mac_ssid==2");
+
+  duk_context* ctx = duk_create_heap_default();
+  ASSERT_NE(ctx, nullptr);
+  evaluatePrefixWithRequestData(ctx, "token=abc%3D%3D",
+      "id=file1&name=config%3Dbackup&type=application%2Foctet-stream");
+
+  EXPECT_TRUE(evaluateJavaScriptBoolean(ctx,
+      "$_GET.mac_ssid === '=2' && $_POST.token === 'abc==' && "
+      "$_FILES.file1.name === 'config=backup'"));
+
+  duk_destroy_heap(ctx);
+}
+
 TEST(general, session_create_multiple_calls_succeed)
 {
   duk_context* ctx = duk_create_heap_default();