Should I use Request.Params instead of explicitly doing Request.Form?

Question

I have been using Request.Form for all my code. And if I need querystring I hit that explicitly too. It came up in a code review that I should probably use the Params collection instead.

I thought it was a best practice, to hit the appropriate collection directly. I am looking for some reinforcement to one side or the other of the argument.

Answer 1

By using the properties under the request you are narrowing down the your retrieval to the proper collection (which is a good thing for readability and performance). I consider your approach to be a best practice and follow it myself.

Answer 2

It is more secure to use Request.Form. This will prevent users from "experimenting" with posted form parameters simply by changing the URL. Using Request.Form doesn't make this secure for "real hackers", but IMHO it's better to use the Form collection.

Answer 3

I have always used Request.Form("Param") or Request.QueryString("Param")

This is purely down to a syntax which is easier to read. I seriously doubt there is a performance impact.

Answer 4

The only time I use Request.Params instead of Form or Querystring is if I don't know whether the method by which the parameters will be passed in.

To put that in context, in 10 years I have used Request.Params in anger only once :)

Kindness,

D

Answer 5

I think it's better to use the Form and QueryString collections explicitly unless you're explicitly trying to define flexible behavior in your application like in a search form where you might want to have the search parameters definable in a URL or saved in cookies such as pagination preferences.

Answer 6

I would use Request.Form and Request.QueryString explicitly. The reason is that the two are not interchangable. The query string is used for HTTP Get requests, and FORM variables for HTTP post requests.

Get requests are typically applicable where you are requesting data, e.g. do a google search, the search words are in the query string. The post are when you are sending data to the web server for processing or storing. So when I say that the two are not interchangable I mean that you cannot change the page from using a GET to a POST without breaking functionality.

So IMHO, the implementation of the page can quite clearly reflect the fact that you intend it to be called by a GET or a POST request.

/Pete