Submission formats

URL-encoded form data

Understand the default application/x-www-form-urlencoded body and how names, values, spaces, and repeated keys are encoded.

8 minute lesson

~~~

A normal POST form uses application/x-www-form-urlencoded unless you choose another encoding.

<form action="/profile" method="post">
  <input name="displayName" value="Ada Lovelace">
  <input name="topic" value="HTML & CSS">
  <button type="submit">Save</button>
</form>

The request body resembles a query string:

displayName=Ada+Lovelace&topic=HTML+%26+CSS

Each name and value is encoded so spaces, ampersands, and other special characters do not break the structure. The server’s form parser reverses that encoding.

This format works well for ordinary text fields. It does not carry file bytes, so forms with file inputs use multipart encoding instead.

Repeated names are valid:

topic=html&topic=css

A parser that turns the body into a simple object may keep only one value. Use an API that preserves every value when the form contract permits repetition.

Encoding is not validation or escaping. A decoded value is still untrusted input. Validate it before storing it, and escape it for the context where you later display it.

Submit a value containing spaces, &, +, and a non-ASCII character. Inspect the raw payload and the server’s decoded values.

Lesson completed