Blog | G5 Cyber Security

Handling Arrays in Web Requests

G5 Cyber Security

TL;DR

Sending arrays of data through HTTP GET or POST requests isn’t directly supported by standard HTML forms. This guide shows you how to format your array data so it can be correctly received and processed on the server-side, using common techniques like comma-separated strings, JSON encoding, and multiple form fields.

1. Understanding the Problem

HTML forms are designed for single values per input field. When you need to send an array (e.g., a list of selected items), you have to represent it in a way that the server can understand. Simply putting multiple values into one form field won’t work as expected.

2. Method 1: Comma-Separated Strings (GET Requests)

This is simplest for GET requests, but has limitations with complex data or values containing commas themselves.

  1. Form Creation: Create your form inputs as usual, but combine the array elements into a single field separated by commas.
  2. Example HTML: 
    <input type="text" name="my_array[]" value="value1,value2,value3">
  3. Server-Side Processing: Split the string on the server side to reconstruct the array. The exact code depends on your server language (PHP example): 
    <?php
$array_string = $_GET['my_array'];
$my_array = explode(',', $array_string);
print_r($my_array); // Output the array
?>
  4. Limitations: This method struggles with values containing commas. It’s also less secure as it doesn’t validate data types or prevent injection attacks easily.

3. Method 2: Multiple Form Fields (POST Requests)

This is a cleaner approach for POST requests, especially when dealing with more complex arrays.

  1. Form Creation: Create separate form fields for each array element, using bracket notation in the field names.
  2. Example HTML: 
    <input type="text" name="my_array[0]" value="value1">
<input type="text" name="my_array[1]" value="value2">
<input type="text" name="my_array[2]" value="value3">
  3. Server-Side Processing: The server will automatically receive $_POST['my_array'] as an array. (PHP example): 
    <?php
print_r($_POST['my_array']); // Output the array
?>
  4. Dynamic Fields: If you don’t know the number of array elements beforehand, you’ll need JavaScript to dynamically add/remove fields.

4. Method 3: JSON Encoding (POST Requests)

This is the most robust and flexible method for complex arrays.

  1. Form Creation: Create a hidden input field to store the array as a JSON string.
  2. Example HTML: 
    <input type="hidden" name="my_array" id="my_array_json">
  3. JavaScript Encoding: Use JavaScript to convert your array into a JSON string before submitting the form. 
    const myArray = ['value1', 'value2', 'value3'];
document.getElementById('my_array_json').value = JSON.stringify(myArray);
  4. Server-Side Processing: Decode the JSON string on the server side to reconstruct the array. (PHP example): 
    <?php
$json_string = $_POST['my_array'];
$my_array = json_decode($json_string, true); // 'true' returns an associative array
print_r($my_array);
?>
  5. Security: Always validate the JSON data on the server side to prevent potential security issues.

5. Choosing the Right Method

Exit mobile version