search

tj / node-querystring

querystring parser for node and the browser - supporting nesting (used by Express, Connect, etc)
MIT License
455 stars 66 forks source link

param=1&param=2 is the same as param[]=1&param[]=2 #38

Open Somebi opened 12 years ago

Somebi commented 12 years ago

This shouldn't be this way, the last param should be taken instead of uniting them into an array.

tj commented 12 years ago

there are no rules really, these are behaviours that other libraries support but I would agree

Marak commented 12 years ago

@Somebi - Disagree.

If you do a plain ole form post with multiple input fields off the same name, the browser will concat these values into a list, it won't just take the last value.

Somebi commented 12 years ago

I just accustomed to that behavior that param[]=value generates an array and param=value&param=value takes the last one. I have created a small helper on client-side, which removes duplicated names.

Marak commented 12 years ago

@Somebi - I'm curious, which other query string parsers act that way? I'm interested in making sure this query string parser behaves nicely.

Somebi commented 12 years ago

Well that was in php + apache.

ghost commented 12 years ago

@Marak This is also the behavior in Ruby/Rails... in fact I was trying to replicate in Express the good old trick of preceding a checkbox input with a hidden field of the same name so that when the checkbox isn't checked I received "0" and when it is I get "1"... but I was surprised to realize that instead I get ["0", "1"] when it's checked.

fizker commented 11 years ago

Just for information, the same question was asked here: http://stackoverflow.com/questions/1746507/authoritative-position-of-duplicate-http-get-query-keys

And they linked to a great document that lists different ways that it is handled: https://www.owasp.org/images/b/ba/AppsecEU09_CarettoniDiPaola_v0.8.pdf. Check page 9 in that document.

The most used is keep either the first or the last value, but there really are no consensus.

Perhaps add an option for choosing which of the 4 different methods to use?

The 4 being:

  1. Keep first (e.g. "1")
  2. Keep last (e.g. "2")
  3. Concatenate via comma (e.g. "1,2")
  4. Concatenate as array (e.g. ["1", "2"])
Orion98MC commented 11 years ago

I Agree with fizker and Somebi. This is expected behavior in rails and php/apache.

Please make it a useful convention to get rid of the extra controller code required so far.

blah238 commented 10 years ago

Looks like the same issue as: https://github.com/visionmedia/node-querystring/issues/9

Any forks with the "keep last" behavior?