Multipart upload form: Is order guaranteed?
Asked Answered
S

1

29

It appears that when I use an html form to make a "Content-Type: multipart/form-data" POST request, the fields always appear in the order in which they are listed in the HTML. In practice, do all browsers do this?

The primary motivation for wanting to know this is so I can do server-side validation of form data w/o being required to cache the entire HTTP request in RAM | disk first.

I know CGI, PHP, etc typically won't do anything 'til the upload completes. Probably because RFC 2388 section 5.5 addresses this issue by saying the order is not defined. I'm working w/ a highly customized fork of thttpd and handling the upload w/ C code built right into the server. So I don't care what most servers do.

What I want to know, is if I go out on a limb and assume an order, will I get burned by that assumption?

Take this form for example:

  <form id="formUpload"
        target = "uploadTarget"
        method = "post"
        action = "/bin/upload"
        enctype= "multipart/form-data" >
    <input type="hidden" id="inUser" name="user" />
    <input type="hidden" id="inDest" name="dest"/>
    <input type="file" id="inFile" name="file" />
    <input type="button" value="Upload" onclick="uploadFile();" />
    <iframe id="uploadTarget" name="uploadTarget" src="" style="width:0;height:0;border:0px"/>
  </form>

The 'uploadFile()' function will fill in the user & dest fields before invoking submit(). I would like to validate user & dest server side as well, before recv()-ing the entire HTTP request body.

Siftings answered 16/9, 2011 at 20:8 Comment(1)
For those who are wondering about FormData(), they also seem to be sent in order. Spec.Intuition
C
33

Yes:

The parts are sent to the processing agent in the same order the corresponding controls appear in the document stream. Part boundaries should not occur in any of the data; how this is done lies outside the scope of this specification.

http://www.w3.org/TR/html4/interact/forms.html#h-17.13.4

Cervantes answered 16/9, 2011 at 20:41 Comment(1)
Thanks for the great answer! Don't know why I didn't think to check the HTML spec. BTW, while testing different browsers, I found that even IE6 was compliant... which I figured meant my assumption was safe, but I feel much better having a spec to reference.Siftings

© 2022 - 2024 — McMap. All rights reserved.