Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

When submitting a GET form, the query string is removed from the action URL

People also ask

Does URL include query string?

A query string is a part of a uniform resource locator (URL) that assigns values to specified parameters.

What represent the query string in the URL?

On the Internet, a querystring (also called an HTTP querystring) is part of the set of characters automatically input in the address bar of a dynamic Web site when a user makes a request for information according to certain criteria.

What form method attribute value instructs the browser to append the form data to the URL for the use in a query string?

<form method=”GET”> The method attribute of the form element tells the web browser how to send form data to a server. Specifying a value of GET means the browser will add the form contents to the end of the URL.


Isn't that what hidden parameters are for to start with...?

<form action="http://www.example.com" method="GET">
  <input type="hidden" name="a" value="1" /> 
  <input type="hidden" name="b" value="2" /> 
  <input type="hidden" name="c" value="3" /> 
  <input type="submit" /> 
</form>

I wouldn't count on any browser retaining any existing query string in the action URL.

As the specifications (RFC1866, page 46; HTML 4.x section 17.13.3) state:

If the method is "get" and the action is an HTTP URI, the user agent takes the value of action, appends a `?' to it, then appends the form data set, encoded using the "application/x-www-form-urlencoded" content type.

Maybe one could percent-encode the action-URL to embed the question mark and the parameters, and then cross one's fingers to hope all browsers would leave that URL as it (and validate that the server understands it too). But I'd never rely on that.

By the way: it's not different for non-hidden form fields. For POST the action URL could hold a query string though.


In HTML5, this is per-spec behaviour.

See Association of controls and forms - Form submission algorithm.

Look at "4.10.22.3 Form submission algorithm", step 17. In the case of a GET form to an http/s URI with a query string:

Let destination be a new URL that is equal to the action except that its <query> component is replaced by query (adding a U+003F QUESTION MARK character (?) if appropriate).

So, your browser will trash the existing "?..." part of your URI and replace it with a new one based on your form.

In HTML 4.01, the spec produces invalid URIs - most browsers didn't actually do this though...

See Forms - Processing form data, step four - the URI will have a ? appended, even if it already contains one.


What you can do is using a simple foreach on the table containing the GET information. For example in PHP :

foreach ($_GET as $key => $value) {
    $key = htmlspecialchars($key);
    $value = htmlspecialchars($value);
    echo "<input type='hidden' name='$key' value='$value'/>";
}

As the GET values are coming from the user, we should escape them before printing on screen.


You should include the two items (a and b) as hidden input elements as well as C.