Index: client.c
===================================================================
--- client.c	(revision 6197)
+++ client.c	(working copy)
@@ -623,6 +623,7 @@
     cupsdClearString(&con->filename);
     cupsdClearString(&con->command);
     cupsdClearString(&con->options);
+    cupsdClearString(&con->query_string);
 
     if (con->request)
     {
@@ -788,6 +789,7 @@
 
 	cupsdClearString(&con->command);
 	cupsdClearString(&con->options);
+	cupsdClearString(&con->query_string);
 
 	if (con->request)
 	{
@@ -2703,6 +2705,7 @@
 
     cupsdClearString(&con->command);
     cupsdClearString(&con->options);
+    cupsdClearString(&con->query_string);
 
     if (!con->http.keep_alive)
     {
@@ -3460,8 +3463,13 @@
   */
 
   if ((options = strchr(con->uri, '?')) != NULL)
+  {
     options ++;
 
+    if (strchr(options, '='))
+      cupsdSetStringf(&(con->query_string), "QUERY_STRING=%s", options);
+  }
+
  /*
   * Check for known types...
   */
@@ -4064,7 +4072,6 @@
 		http_user_agent[1024],	/* HTTP_USER_AGENT environment variable */
 		lang[1024],		/* LANG environment variable */
 		path_info[1024],	/* PATH_INFO environment variable */
-		*query_string,		/* QUERY_STRING env variable */
 		remote_addr[1024],	/* REMOTE_ADDR environment variable */
 		remote_host[1024],	/* REMOTE_HOST environment variable */
 		remote_user[1024],	/* REMOTE_USER environment variable */
@@ -4095,8 +4102,7 @@
                   "pipe_command: command=\"%s\", options=\"%s\"",
                   command, options ? options : "(null)");
 
-  argv[0]      = command;
-  query_string = NULL;
+  argv[0] = command;
 
   if (options)
     strlcpy(argbuf, options, sizeof(argbuf));
@@ -4123,10 +4129,12 @@
     path_info[0] = '\0';
   }
 
-  if (*commptr == '?' && con->operation == HTTP_GET)
+  cupsdLogMessage(CUPSD_LOG_INFO, "commptr=\"%s\"", commptr);
+
+  if (*commptr == '?' && con->operation == HTTP_GET && !con->query_string)
   {
     commptr ++;
-    cupsdSetStringf(&query_string, "QUERY_STRING=%s", commptr);
+    cupsdSetStringf(&(con->query_string), "QUERY_STRING=%s", commptr);
   }
 
   argc = 1;
@@ -4257,18 +4265,15 @@
 
   if (con->operation == HTTP_GET)
   {
-    for (i = 0; i < argc; i ++)
-      cupsdLogMessage(CUPSD_LOG_DEBUG2, "argv[%d] = \"%s\"", i, argv[i]);
-
     envp[envc ++] = "REQUEST_METHOD=GET";
 
-    if (query_string)
+    if (con->query_string)
     {
      /*
       * Add GET form variables after ?...
       */
 
-      envp[envc ++] = query_string;
+      envp[envc ++] = con->query_string;
     }
   }
   else
@@ -4312,8 +4317,6 @@
 
   if (cupsdOpenPipe(fds))
   {
-    cupsdClearString(&query_string);
-
     cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to create pipes for CGI %s - %s",
                     argv[0], strerror(errno));
     return (0);
@@ -4351,8 +4354,6 @@
     close(fds[1]);
   }
 
-  cupsdClearString(&query_string);
-
   return (pid);
 }
 
Index: client.h
===================================================================
--- client.h	(revision 6197)
+++ client.h	(working copy)
@@ -41,7 +41,8 @@
 					/* Localized URL/URI for GET/PUT */
 			*filename,	/* Filename of output file */
 			*command,	/* Command to run */
-			*options;	/* Options for command */
+			*options,	/* Options for command */
+			*query_string;	/* QUERY_STRING environment variable */
   int			file;		/* Input/output file */
   int			file_ready;	/* Input ready on file/pipe? */
   int			pipe_pid;	/* Pipe process ID (or 0 if not a pipe) */