The QUERY-STRING Component

In the context of WEB-ARCHITECTURE, a QUERY-STRING is the part of a UNIFORM-RESOURCE-IDENTIFIER (URI) that contains data to be passed to WEB-APPLICATIONS. It is primarily used to store KEY-VALUE-PAIRS that modify the behavior of a resource. According to the IETF RFC 3986, the query string is separated from the URL-PATH by a question mark (?) and is terminated by the end of the URL or a fragment identifier (#).

Data within a QUERY-STRING must be formatted according to specific rules. Multiple parameters are typically delimited by the ampersand (&) or semicolon (;). Because URLS can only contain a limited set of characters from the US-ASCII character set, any other characters must be converted using PERCENT-ENCODING. This ensures compatibility across different WEB-BROWSERS and SERVERS.

From a SECURITY standpoint, QUERY-STRING parameters are considered untrusted input. They are susceptible to CROSS-SITE-SCRIPTING (XSS) and SQL-INJECTION if not properly sanitized. Furthermore, sensitive data like AUTHENTICATION-TOKENS should avoid being placed in the query string to prevent INFORMATION-LEAKAGE via REFERRER-HEADERS. Detailed implementation guidelines are available via MDN Web Docs and the W3C Form Specifications.

• HTTP-GET
• URL-ENCODING
• REST-API
• WEB-FORMS