Menu
Home
People
Places
Arts
History
Plants & Animals
Science
Life & Culture
Technology
Reference.org
Query string
open-in-new
<h2 id="structure">Structure</h2><p> A typical URL containing a query string is as follows:</p><blockquote><p>https://example.com/over/there?name=ferret</p></blockquote> <p>When a server receives a request for such a page, it may run a program, passing the query string, which in this case is name=ferret, unchanged to the program. The question mark is used as a separator, and is not part of the query string.<a class="footnote-ref" id="fnref:1" href="#fn:1"><sup>1</sup></a><a class="footnote-ref" id="fnref:2" href="#fn:2"><sup>2</sup></a> </p><p><a href="/facts/Web_Framework/8f1CVHDX">Web frameworks</a> may provide methods for parsing multiple parameters in the query string, separated by some delimiter.<a class="footnote-ref" id="fnref:3" href="#fn:3"><sup>3</sup></a> In the example URL below, multiple query parameters are separated by the <a href="/facts/Ampersand/emmXUXuB">ampersand</a>, "&": </p> <blockquote><p>https://example.com/path/to/page?name=ferret&color=purple</p></blockquote> <p>The exact structure of the query string is not standardized. Methods used to parse the query string may differ between websites. </p><p>A link in a web page may have a URL that contains a query string. <a href="/facts/HTML/sSc3fT78">HTML</a> defines three ways a user agent can generate the query string: </p> <ul><li>an <a href="/facts/Form_(HTML)/9Ivp2peo">HTML form</a> via the <form>...</form> element</li> <li>a <a href="/facts/Image_map/jccIBPCz">server-side image map</a> via the ismap attribute on the <img> element with an <img ismap> construction</li> <li>an indexed search via the now deprecated <isindex> element</li></ul> <h3>Web forms</h3> <p>One of the original uses was to contain the content of an <a href="/facts/Form_(HTML)/9Ivp2peo">HTML form</a>, also known as web form. In particular, when a form containing the fields field1, field2, field3 is submitted, the content of the fields is encoded as a query string as follows: </p> <blockquote><p>field1=value1&field2=value2&field3=value3...</p></blockquote> <ul><li>The query string is composed of a series of field-value pairs.</li> <li>Within each pair, the field name and value are separated by an <a href="/facts/Equals_sign/AweYSg9h">equals sign</a>, "=".</li> <li>The series of pairs is separated by the <a href="/facts/Ampersand/emmXUXuB">ampersand</a>, "&" (<a href="/facts/Semicolons/VY8VsSPC">semicolons</a> ";" are not recommended by the <a href="/facts/W3C/lGWmhF6M">W3C</a> anymore, see below).</li></ul> <p>While there is no definitive standard, most <a href="/facts/Web_framework/8f1CVHDX">web frameworks</a> allow multiple values to be associated with a single field (e.g. field1=value1&field1=value2&field2=value3).<a class="footnote-ref" id="fnref:4" href="#fn:4"><sup>4</sup></a><a class="footnote-ref" id="fnref:5" href="#fn:5"><sup>5</sup></a> </p><p>For each <a href="/facts/Field_(computer_science)/jt622EDb">field</a> of the form, the query string contains a pair field=value. Web forms may include fields that are not visible to the user; these fields are included in the query string when the form is submitted. </p><p>This convention is a <a href="/facts/W3C/lGWmhF6M">W3C</a> recommendation.<a class="footnote-ref" id="fnref:6" href="#fn:6"><sup>6</sup></a> In the recommendations of 1999, W3C recommended that all web servers support <a href="/facts/Semicolon/VY8VsSPC">semicolon</a> separators in addition to <a href="/facts/Ampersand/emmXUXuB">ampersand</a> separators<a class="footnote-ref" id="fnref:7" href="#fn:7"><sup>7</sup></a> to allow <a href="/facts/Application%2fx-www-form-urlencoded/zprLw5se">application/x-www-form-urlencoded</a> query strings in URLs within HTML documents without having to entity escape ampersands. Since 2014, W3C recommends to use only <a href="/facts/Ampersand/emmXUXuB">ampersand</a> as query separator.<a class="footnote-ref" id="fnref:8" href="#fn:8"><sup>8</sup></a> </p><p>The form content is only encoded in the URL's query string when the form submission method is <a href="/facts/GET_(HTTP)/TWtvf7JD">GET</a>. The same encoding is used by default when the submission method is <a href="/facts/POST_(HTTP)/UtxXc5qG">POST</a>, but the result is submitted as the <a href="/facts/HTTP_request/TWtvf7JD">HTTP request</a> body rather than being included in a modified URL.<a class="footnote-ref" id="fnref:9" href="#fn:9"><sup>9</sup></a> </p> <h3>Indexed search</h3> <p>Before <a href="/facts/Form_(HTML)/9Ivp2peo">forms</a> were added to HTML, browsers rendered the –<isindex> element as a single-line text-input control. The text entered into this control was sent to the server as a query string addition to a <a href="/facts/GET_(HTTP)/TWtvf7JD">GET</a> request for the base URL or another URL specified by the action attribute.<a class="footnote-ref" id="fnref:10" href="#fn:10"><sup>10</sup></a> This was intended to allow web servers to use the provided text as query criteria so they could return a list of matching pages.<a class="footnote-ref" id="fnref:11" href="#fn:11"><sup>11</sup></a> </p><p>When the text input into the indexed search control is submitted, it is encoded as a query string as follows: </p> <blockquote><p>argument1+argument2+argument3...</p></blockquote> <ul><li>The query string is composed of a series of arguments by parsing the text into words at the spaces.</li> <li>The series is separated by the <a href="/facts/Plus_sign/6RJD4Xt9">plus sign</a>, '+'.</li></ul> <p>Though the <isindex> element is deprecated and most browsers no longer support or render it, there are still some vestiges of indexed search in existence. For example, this is the source of the special handling of <a href="/facts/Plus_sign/6RJD4Xt9">plus sign</a>, '+' within browser URL percent encoding (which today, with the deprecation of indexed search, is all but redundant with %20). Also some web servers supporting <a href="/facts/Common_Gateway_Interface/zWsLFXGJ">CGI</a> (e.g., <a href="/facts/Apache_HTTP_Server/tcmWYYUq">Apache</a>) will process the query string into command line arguments if it does not contain an <a href="/facts/Equals_sign/AweYSg9h">equals sign</a>, '=' (as per section 4.4 of CGI 1.1). Some CGI scripts still depend on and use this historic behavior for URLs embedded in HTML. </p> <h2 id="url-encoding">URL encoding</h2> <p class="note">Main article: <a href="/facts/Percent-encoding/zprLw5se">Percent-encoding</a></p> <p>Some <a href="/facts/Character_(computing)/X2zKLFFB">characters</a> cannot be part of a URL (for example, the space) and some other characters have a special meaning in a URL: for example, the character # can be used to further specify a subsection (or <a href="/facts/Fragment_identifier/lbA3Apwq">fragment</a>) of a document. In HTML forms, the character = is used to separate a name from a value. The URI generic syntax uses <a href="/facts/Percent-encoding/zprLw5se">URL encoding</a> to deal with this problem, while HTML forms make some additional substitutions rather than applying percent encoding for all such characters. SPACE is encoded as '+' or "%20".<a class="footnote-ref" id="fnref:12" href="#fn:12"><sup>12</sup></a> </p><p><a href="/facts/HTML_5/HBAxEAr6">HTML 5</a> specifies the following transformation for submitting HTML forms with the "GET" method to a web server. The following is a brief summary of the algorithm: </p> <ul><li>Characters that cannot be converted to the correct charset are replaced with HTML <a href="/facts/Numeric_character_reference/wCEzNIlC">numeric character references</a><a class="footnote-ref" id="fnref:13" href="#fn:13"><sup>13</sup></a></li> <li>SPACE is encoded as '+' or '%20'</li> <li>Letters (A–Z and a–z), numbers (0–9) and the characters '~','-','.' and '_' are left as-is</li> <li>+ is encoded by %2B</li> <li>All other characters are encoded as a %HH <a href="/facts/Hexadecimal/02ohQW22">hexadecimal</a> representation with any non-ASCII characters first encoded as UTF-8 (or other specified encoding)</li></ul> <p>The octet corresponding to the tilde ("~") is permitted in query strings by RFC3986 but required to be percent-encoded in HTML forms to "%7E". </p><p>The encoding of SPACE as '+' and the selection of "as-is" characters distinguishes this encoding from RFC 3986. </p> <h2 id="example">Example</h2> <p>If a <a href="/facts/Form_(web)/9Ivp2peo">form</a> is embedded in an <a href="/facts/HTML/sSc3fT78">HTML</a> page as follows: </p> <form action="/cgi-bin/test.cgi" method="get"> <input type="text" name="first" /> <input type="text" name="second" /> <input type="submit" /> </form> <p>and the user inserts the strings "this is a field" and "was it clear (already)?" in the two <a href="/facts/Text_box/EkGobmNI">text fields</a> and presses the submit button, the program test.cgi (the program specified by the action <a href="/facts/HTML_attribute/0zRQefTK">attribute</a> of the form <a href="/facts/HTML_element/s4TKzjUP">element</a> in the above example) will receive the following query string: first=this+is+a+field&second=was+it+clear+%28already%29%3F. </p><p>If the form is processed on the <a href="/facts/Web_server/A4GS6thA">server</a> by a <a href="/facts/Common_Gateway_Interface/zWsLFXGJ">CGI</a> <a href="/facts/Scripting_language/8pF4ajBL">script</a>, the script may typically receive the query string as an <a href="/facts/Environment_variable/WxkrJQpP">environment variable</a> named QUERY_STRING. </p> <h2 id="tracking">Tracking</h2> <p>A program receiving a query string can ignore part or all of it. If the requested URL corresponds to a file and not to a program, the whole query string is ignored. However, regardless of whether the query string is used or not, the whole URL including it is stored in the server <a href="/facts/Computer_data_logging/p7FHf8mA">log files</a>. </p><p>These facts allow query strings to be used to track users in a manner similar to that provided by <a href="/facts/HTTP_cookie/o1laXyng">HTTP cookies</a>. For this to work, every time the user downloads a page, a unique identifier must be chosen and added as a query string to the URLs of all links the page contains. As soon as the user follows one of these links, the corresponding URL is requested to the server. This way, the download of this page is linked with the previous one. </p><p>For example, when a web page containing the following is requested: </p> <a href="foo.html">see my page!</a> <a href="bar.html">mine is better</a> <p>a unique string, such as e0a72cb2a2c7 is chosen, and the page is modified as follows: </p> <a href="foo.html?e0a72cb2a2c7">see my page!</a> <a href="bar.html?e0a72cb2a2c7">mine is better</a> <p>The addition of the query string does not change the way the page is shown to the user. When the user follows, for example, the first link, the browser requests the page foo.html?e0a72cb2a2c7 to the server, which ignores what follows ? and sends the page foo.html as expected, adding the query string to its links as well. </p><p>This way, any subsequent page request from this user will carry the same query string e0a72cb2a2c7, making it possible to establish that all these pages have been viewed by the same user. Query strings are often used in association with <a href="/facts/Web_beacon/QRBzDwUX">web beacons</a>. </p><p>The main differences between query strings used for tracking and HTTP cookies are that: </p> <ol><li>Query strings form part of the URL, and are therefore included if the user saves or sends the URL to another user; cookies can be maintained across browsing sessions, but are not saved or sent with the URL.</li> <li>If the user arrives at the same web server by two (or more) independent paths, it will be assigned two different query strings, while the stored cookies are the same.</li> <li>The user can disable cookies, in which case using cookies for tracking does not work. However, using query strings for tracking should work in all situations.</li> <li>Different query strings passed by different visits to the page will mean that the pages are never served from the browser (or proxy, if present) cache thereby increasing the load on the web server and slowing down the user experience.</li></ol> <h2 id="compatibility-issues">Compatibility issues</h2> <p>According to the <a href="/facts/Hypertext_Transfer_Protocol/TWtvf7JD">HTTP</a> specification: </p> <blockquote><p>Various ad hoc limitations on request-line length are found in practice. It is RECOMMENDED that all HTTP senders and recipients support, at a minimum, request-line lengths of 8000 octets.<a class="footnote-ref" id="fnref:14" href="#fn:14"><sup>14</sup></a></p></blockquote> <p>If the URL is too long, the web server fails with the <a href="/facts/List_of_HTTP_status_codes/nTtX2f6r">414 Request-URI Too Long</a> HTTP status code. </p><p>The common workaround for these problems is to use <a href="/facts/POST_(HTTP)/UtxXc5qG">POST</a> instead of <a href="/facts/GET_(HTTP)/TWtvf7JD">GET</a> and store the parameters in the request body. The length limits on request bodies are typically much higher than those on URL length. For example, the limit on POST size, by default, is 2 MB on IIS 4.0 and 128 KB on IIS 5.0. The limit is configurable on Apache2 using the LimitRequestBody directive, which specifies the number of bytes from 0 (meaning unlimited) to 2147483647 (2 GB) that are allowed in a request body.<a class="footnote-ref" id="fnref:15" href="#fn:15"><sup>15</sup></a> </p> <h2 id="see-also">See also</h2> <ul><li><a href="/facts/Clean_URL/zqJIfg7q">Clean URL</a></li> <li><a href="/facts/DoubleClick_Click_Identifier/wnPzq5Hf">Click identifier</a></li> <li><a href="/facts/Common_Gateway_Interface/zWsLFXGJ">Common Gateway Interface</a> (CGI)</li> <li><a href="/facts/HTTP_cookie/o1laXyng">HTTP cookie</a></li> <li><a href="/facts/HyperText_Transfer_Protocol/TWtvf7JD">HyperText Transfer Protocol</a> (HTTP)</li> <li><a href="/facts/Semantic_URL/zqJIfg7q">Semantic URLs</a></li> <li><a href="/facts/URI_fragment/lbA3Apwq">URI fragment</a></li> <li><a href="/facts/URI_normalization/wUyUTo9R">URI normalization</a></li> <li><a href="/facts/URI_scheme/Ae3AaLCl">URI scheme</a></li> <li><a href="/facts/UTM_parameters/bvjEXRP1">UTM parameters</a></li> <li><a href="/facts/Web_beacon/QRBzDwUX">Web beacon</a></li></ul> <h2 id="references">References</h2> <ol> <li id="fn:1"><p>T. Berners-Lee; R. Fielding; L. Masinter (January 2005). "RFC 3986". "Syntax Components" (section 3). <a href="http://tools.ietf.org/html/rfc3986#section-3" target="_blank">http://tools.ietf.org/html/rfc3986#section-3</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li> <li id="fn:2"><p>T. Berners-Lee; R. Fielding; L. Masinter (January 2005). "RFC 3986". "Query" (section 3.4). <a href="http://tools.ietf.org/html/rfc3986#section-3.4" target="_blank">http://tools.ietf.org/html/rfc3986#section-3.4</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li> <li id="fn:3"><p>Forms in HTML documents. W3.org. Retrieved on 2013-09-08. <a href="https://www.w3.org/TR/REC-html40/interact/forms.html#form-content-type" target="_blank">https://www.w3.org/TR/REC-html40/interact/forms.html#form-content-type</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></p></li> <li id="fn:4"><p>"ServletRequest (Java EE 6 )". docs.oracle.com. 2011-02-10. Retrieved 2013-09-08. <a href="https://docs.oracle.com/javaee/6/api/javax/servlet/ServletRequest.html#getParameterValues(java.lang.String)" target="_blank">https://docs.oracle.com/javaee/6/api/javax/servlet/ServletRequest.html#getParameterValues(java.lang.String)</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></p></li> <li id="fn:5"><p>"uri – Authoritative position of duplicate HTTP GET query keys". Stack Overflow. 2013-06-09. Retrieved 2013-09-08. <a href="https://stackoverflow.com/questions/1746507/authoritative-position-of-duplicate-http-get-query-keys" target="_blank">https://stackoverflow.com/questions/1746507/authoritative-position-of-duplicate-http-get-query-keys</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></p></li> <li id="fn:6"><p>Forms in HTML documents. W3.org. Retrieved on 2013-09-08. <a href="https://www.w3.org/TR/REC-html40/interact/forms.html#form-content-type" target="_blank">https://www.w3.org/TR/REC-html40/interact/forms.html#form-content-type</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></p></li> <li id="fn:7"><p>Performance, Implementation, and Design Notes. W3.org. Retrieved on 2013-09-08. <a href="http://www.w3.org/TR/1999/REC-html401-19991224/appendix/notes.html#h-B.2.2" target="_blank">http://www.w3.org/TR/1999/REC-html401-19991224/appendix/notes.html#h-B.2.2</a> <a href="#fnref:7" class="footnote-back-ref">↩</a></p></li> <li id="fn:8"><p>"4.10 Forms — HTML5". <a href="https://www.w3.org/TR/2014/REC-html5-20141028/forms.html#url-encoded-form-data" target="_blank">https://www.w3.org/TR/2014/REC-html5-20141028/forms.html#url-encoded-form-data</a> <a href="#fnref:8" class="footnote-back-ref">↩</a></p></li> <li id="fn:9"><p>[1], HTML5.2, W3C recommendation, 14 December 2017 <a href="https://www.w3.org/TR/html52/sec-forms.html#form-submission-algorithm" target="_blank">https://www.w3.org/TR/html52/sec-forms.html#form-submission-algorithm</a> <a href="#fnref:9" class="footnote-back-ref">↩</a></p></li> <li id="fn:10"><p>"<isindex>". HTML (HyperText Markup Language). Archived from the original on 2017-10-19. Retrieved 2015-11-21. <a href="https://web.archive.org/web/20171019030835/https://developer.mozilla.org/en-US/docs/Web/HTML/Element/isindex" target="_blank">https://web.archive.org/web/20171019030835/https://developer.mozilla.org/en-US/docs/Web/HTML/Element/isindex</a> <a href="#fnref:10" class="footnote-back-ref">↩</a></p></li> <li id="fn:11"><p>"HTML/Elements/isindex". W3C Wiki. Archived from the original on 2021-06-22. Retrieved 2020-03-20. <a href="https://web.archive.org/web/20210622024419/https://www.w3.org/wiki/HTML/Elements/isindex" target="_blank">https://web.archive.org/web/20210622024419/https://www.w3.org/wiki/HTML/Elements/isindex</a> <a href="#fnref:11" class="footnote-back-ref">↩</a></p></li> <li id="fn:12"><p>"HTML URL Encoding Reference". W3Schools. Retrieved May 1, 2013. <a href="https://www.w3schools.com/tags/ref_urlencode.asp" target="_blank">https://www.w3schools.com/tags/ref_urlencode.asp</a> <a href="#fnref:12" class="footnote-back-ref">↩</a></p></li> <li id="fn:13"><p>The application/x-www-form-urlencoded encoding algorithm, HTML5.2, W3C recommendation, 14 December 2017 <a href="https://www.w3.org/TR/html52/sec-forms.html#application-x-www-form-urlencoded-encoding-algorithm" target="_blank">https://www.w3.org/TR/html52/sec-forms.html#application-x-www-form-urlencoded-encoding-algorithm</a> <a href="#fnref:13" class="footnote-back-ref">↩</a></p></li> <li id="fn:14"><p>HTTP/1.1 Message Syntax and Routing. ietf.org. Retrieved on 2014-07-31. <a href="https://tools.ietf.org/html/rfc7230#section-3.1.1" target="_blank">https://tools.ietf.org/html/rfc7230#section-3.1.1</a> <a href="#fnref:14" class="footnote-back-ref">↩</a></p></li> <li id="fn:15"><p>core – Apache HTTP Server. Httpd.apache.org. Retrieved on 2013-09-08. <a href="https://httpd.apache.org/docs/2.2/mod/core.html#limitrequestbody" target="_blank">https://httpd.apache.org/docs/2.2/mod/core.html#limitrequestbody</a> <a href="#fnref:15" class="footnote-back-ref">↩</a></p></li> </ol>