Question

For a given HTML form, is a user agent required to build the submit request in a particular order?

I was looking through the HTML 4.0.1 Specification and it doesn’t seem to specify the order that "successful controls" become part of the request on submission. Section 17.13.3, Processing form data, states:

When the user submits a form (e.g., by activating a submit button), the user agent processes it as follows.

Step one: Identify the successful controls

Step two: Build a form data set

A form data set is a sequence of control-name/current-value pairs constructed from successful controls

Step three: Encode the form data set

The form data set is then encoded according to the content type specified by the enctype attribute of the FORM element.

Step four: Submit the encoded form data set

At step two, the form data set is described as a sequence, so the order in which it is encoded in Step 3 is presumably fixed. But, this begs the question of what the order of successful controls is in the form data set.

For example, given the following HTML form:

<form action="#" method="GET">
<input type="hidden" name="key1" value="value1" />
<div>
    <div>
        <input type="hidden" name="key2" value="value2" />
    </div>
    <input type="hidden" name="key3" value="value3" />
    <input type="submit" name="submit" value="Submit" />
</div>
<input type="hidden" name="key5" value="value5" />
</form>

Could the form data set be

[ ("key1", "value1"), ("key2", "value2"), ("key3", "value3"), ("submit", "Submit"), ("key5", "value5") ]

(I.e. a depth-first search of the DOM); or

[ ("key1", "value1"), ("key5", "value5"), ("key3", "value3"), ("submit", "Submit"), ("key2", "value2") ]

(A breadth-first search); or even a nondeterministic order resulting from iterating the control-name/current-value pairs in a randomized hashtable?

Testing this form with IE 9 and Firefox 9.0.1, it seems that both use the depth-first search order. Perhaps other browsers are different. The question is whether this order is prescribed somewhere.

Answer 1

If you continue to section 17.13.4 of the HTML spec, it states that the default content type is application/x-www-form-urlencoded. The section for that content type says:

The control names/values are listed in the order they appear in the document.

This would suggest a depth-first traversal and would seem to agree with your browser tests.