Question

I’m using the commons FileUpload as part of a custom uploader implementation. In particular, I am using ServletFileUpload and the Streaming API ( http://commons.apache.org/fileupload/streaming.html ). The API for the getItemIterator() method in the ServletFileUpload says that it is guaranteed to return an iterator of FileItemStreams, in the ‘order that they were transmitted’. Maybe this is a stupid question, but when submitting an HTML form, is this order guaranteed to be the order that the HTML form inputs exist on the corresponding HTML page? So far this seems to be the case, but I need to make sure that this is the guaranteed behavior.

EXAMPLE:

<form method="post" name="test" action="/upload">
    <input type="hidden" name="param1" value="1" />
    <input type="hidden" name="param2" value="2" />
    <input type="hidden" name="param3" value="3" />
    <input type="file" name="test_file" />
</form>


// Example JAVA ...
// Is the iterator guaranteed to return streams in the order: param1, param2, param3, test_file?
ServletFileUpload upload = new ServletFileUpload();
FileItemIterator iter = upload.getItemIterator(request);

Answer 1

Yes, this is in turn specified in W3C HTML Forms Spec – Chapter 17.13.4 Form content types. Here’s an extract of relevance (see emphasis in last paragraph):

17.13.4 Form content types

…

application/x-www-form-urlencoded

This is the default content type. Forms submitted with this content type must be encoded as follows:

Control names and values are escaped. Space characters are replaced by '+', and then reserved characters are escaped as described in [RFC1738], section 2.2: Non-alphanumeric characters are replaced by '%HH', a percent sign and two hexadecimal digits representing the ASCII code of the character. Line breaks are represented as "CR LF" pairs (i.e., '%0D%0A').

The control names/values are listed in the order they appear in the document. The name is separated from the value by '=' and name/value pairs are separated from each other by '&'.