Not entirely true. *get_vars* is holding all parameters in a GET request. 
The only way to pass parameters in a GET request is to have ?var1=1&var2=2 
as part of the url. *post_vars* is holding all parameters sent in a POST 
request.
 
Here's the catch: in CGI there are multiple ways to submit params in a POST 
request:
- with the "query string"
- with body holding the "query string" (application/x-www-form-urlencoded)
- with body holding a mime format (multipart/form-data)

web2py "merges" *get_vars* and *post_vars* in *vars*.

FORM and all derivations of SQLFORM use a form with method="POST" and 
enctype=multipart/form-data unless specified otherwise, and usually the 
action where they POST is the same page that generated the form itself 
(postbacks) without a "query string" (web2py has nicer and cleaner urls, so 
usually coders don't fiddle a lot with 
?verylong=1&filled_with_parameters=1&thatyoucantevenread=2 "query string").
The fact that there's a *get_vars* and a *post_vars* clearly lead to assume 
that *get_** is only filled with GET requests and *post_* *gets only filled 
with POST requests. We were slowly accepting instead that *get_vars* was 
something more like *parsed_query_string*, because the previous code merged 
them preferring the parameter passed with POST over GET if the content-type 
was multipart.

The new streamlined method kinda "followed the flow" (my fault). 
As discussed in issue 1647 *get_vars* should only be filled with the parsed 
"query string" in a GET request, not in a POST one.

For all intents and purposes, a POST request to an url with some parameters 
in "query string" and some parameters in the body needs to be parsed into *
post_vars* only, as if the parameters sent with the "query string" were 
indeed included in the body.



On Thursday, August 22, 2013 11:50:45 AM UTC+2, Tim Richardson wrote:
>
> Not directly related, but this issue has made me more aware of the 
> difference between GET and POST while using web2py. 
> Is this correct: 
> Variables sent from one of web2py's forms (FORM, SQLFORM, SQLFORM.factory, 
> etc) are POSTed, I think (by default)
> URL variables are GETted.
>
>

-- 

--- 
You received this message because you are subscribed to the Google Groups 
"web2py-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to web2py+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

Reply via email to