Classic ASP Forms: GET, POST and the Request Object

In Classic ASP, read values submitted through a form using Request.QueryString() for GET or Request.Form() for POST. For a field named name, the two direct statements are:

<%
Dim userName
userName = Request.QueryString("name")  ' GET form
userName = Request.Form("name")         ' POST form
%>

Use the line that matches your form method; the second assignment is not needed if you use GET. When displaying a visitor’s value as HTML, write Server.HTMLEncode(userName) rather than printing untrusted text directly. See another example of Server.HTMLEncode().

HTML forms use the method attribute to select GET or POST and the action attribute to identify the receiving page. These examples run in Classic ASP (.asp) on IIS; this PHP tutorial page displays the code but does not execute it.

GET vs POST in Classic ASP

Both methods transmit form fields as name/value pairs. They differ in where the values are sent and how applications should use them. For a fuller comparison, read GET and POST differences in ASP.

Remember: POST alone is not encryption. Use HTTPS for both methods, validate values on the server, and never assume submitted fields are trustworthy.

Basic HTML Form Structure

This form sends its name input to receive.asp with POST. The name attribute is essential: it is the key read by Classic ASP. The id connects the label with the control.

<form action="receive.asp" method="post">
  <label for="name">Your name</label>
  <input type="text" id="name" name="name" required>
  <button type="submit">Send</button>
</form>

A field with only an id and no name is not normally sent as a named form value. Disabled controls also are not submitted. The browser’s required attribute improves usability, but server-side validation is still necessary.

GET Method: Request.QueryString()

A GET form is appropriate when the submitted values describe a search or filter. In this example, enter a product name in search.asp and submit to search-results.asp.

Step 1: Create search.asp

 Copy<!DOCTYPE html>
<html lang="en">
<head><meta charset="utf-8"><title>Search products</title></head>
<body>
  <form action="search-results.asp" method="get">
    <label for="q">Search products</label>
    <input type="search" id="q" name="q" required>
    <button type="submit">Search</button>
  </form>
</body>
</html>

Searching for school bag generates a URL similar to the one below. The browser handles encoding the space in the submitted value:

https://www.example.com/search-results.asp?q=school+bag

Step 2: Create search-results.asp

The receiving page reads q, trims extra spaces, and safely writes the value to the page. The value is not automatically used to search a database.

 Copy<%
Option Explicit
Dim query
query = Trim(Request.QueryString("q"))
Response.ContentType = "text/html"
Response.Charset = "utf-8"
If Len(query) = 0 Then
    Response.Write "Please enter a search term."
Else
    Response.Write "You searched for: " & Server.HTMLEncode(query)
End If
%>

Sample output: You searched for: school bag. The query string is suitable for bookmarkable searches, pagination or sorting; avoid placing passwords and other secrets in the URL.

Read individual GET parameters

For a URL such as products.asp?category=books&page=2, use the field names as quoted strings:

<%
Dim category, pageNumber
category = Request.QueryString("category")
pageNumber = Request.QueryString("page")
Response.Write Server.HTMLEncode(category)
%>

When a query parameter is intended to be numeric, first verify it is present and valid, then convert it. Do not concatenate an unvalidated query parameter directly into a database command. See SQL SELECT in Classic ASP for related database examples.

POST Method: Request.Form()

A POST form sends input values in the request body instead of the query string. Here is a small feedback example with a name and message. For a more complete project, see the ASP feedback form tutorial.

Step 1: Create feedback-form.asp

 Copy<!DOCTYPE html>
<html lang="en">
<head><meta charset="utf-8"><title>Send feedback</title></head>
<body>
  <form action="feedback-receive.asp" method="post">
    <label for="fullName">Name</label>
    <input type="text" id="fullName" name="fullName" maxlength="80" required>
    <label for="message">Message</label>
    <textarea id="message" name="message" maxlength="1000" required></textarea>
    <button type="submit">Send feedback</button>
  </form>
</body>
</html>

Step 2: Create feedback-receive.asp

Check that the page receives a POST request, then read the fields using Request.Form(). This demonstration validates and displays the message; it does not send email or store anything.

 Copy<%
Option Explicit
Dim fullName, message
Response.ContentType = "text/html"
Response.Charset = "utf-8"
If Request.ServerVariables("REQUEST_METHOD") <> "POST" Then
    Response.Write "Please submit the feedback form first."
Else
    fullName = Trim(Request.Form("fullName"))
    message = Trim(Request.Form("message"))
    If Len(fullName) = 0 Or Len(message) = 0 Then
        Response.Write "Both fields are required."
    ElseIf Len(fullName) > 80 Or Len(message) > 1000 Then
        Response.Write "The submitted text is too long."
    Else
        Response.Write "Thank you, " & Server.HTMLEncode(fullName) & "<br>"
        Response.Write "Message: " & Server.HTMLEncode(message)
    End If
End If
%>

Because the message is displayed inside HTML, Server.HTMLEncode() is essential. In real applications, verify permissions and validation rules before saving data. If data goes into SQL, use parameterized queries rather than building a statement from submitted strings.

Handle a POST Form on the Same ASP Page

You can display and process the form in a single .asp file. Save this complete example as contact.asp. The page first displays the form; after submission it validates the name and safely displays a greeting.

 Copy<%
Option Explicit
Dim userName, errorMessage, isSubmitted
Response.ContentType = "text/html"
Response.Charset = "utf-8"
userName = ""
errorMessage = ""
isSubmitted = Request.ServerVariables("REQUEST_METHOD") = "POST"

If isSubmitted Then
    userName = Trim(Request.Form("userName"))
    If Len(userName) = 0 Then
        errorMessage = "Please enter your name."
    ElseIf Len(userName) > 80 Then
        errorMessage = "Name must be 80 characters or fewer."
    End If
End If
%>
<!DOCTYPE html>
<html lang="en">
<head><meta charset="utf-8"><title>Classic ASP contact form</title></head>
<body>
<% If isSubmitted And errorMessage = "" Then %>
  <p>Welcome, <%= Server.HTMLEncode(userName) %>!</p>
<% Else %>
  <% If errorMessage <> "" Then %>
    <p role="alert"><%= Server.HTMLEncode(errorMessage) %></p>
  <% End If %>
  <form action="contact.asp" method="post">
    <label for="userName">Your name</label>
    <input type="text" id="userName" name="userName"
           maxlength="80" required
           value="<%= Server.HTMLEncode(userName) %>">
    <button type="submit">Submit</button>
  </form>
<% End If %>
</body>
</html>

How it works: Request.ServerVariables("REQUEST_METHOD") identifies whether the page received a POST request. The ASP block runs before the HTML. If validation succeeds, the page displays a greeting; otherwise, it displays the form and any validation message. HTML attributes containing user input are also encoded. Remember that the form's action must match the filename you actually save.

For a production application, consider a post/redirect/get flow after a successful change to help avoid accidental repeat submissions when users refresh the page. Also add CSRF defenses to state-changing forms.

Check Boxes and Multiple Values

Unlike a single text field, multiple checkboxes may share the same name. When more than one is selected, Classic ASP makes the values available through the same Request.Form collection. Learn more in the checkbox tutorial and radio button tutorial.

 Copy<form action="interests.asp" method="post">
  <fieldset>
    <legend>Choose interests</legend>
    <label><input type="checkbox" name="interest" value="ASP"> ASP</label>
    <label><input type="checkbox" name="interest" value="SQL"> SQL</label>
    <label><input type="checkbox" name="interest" value="HTML"> HTML</label>
  </fieldset>
  <button type="submit">Send</button>
</form>

Inside interests.asp, use .Count and the one-based index to read each selected value. If no boxes are checked, the count is zero.

 Copy<%
Option Explicit
Dim i, selectedCount
selectedCount = Request.Form("interest").Count
If selectedCount = 0 Then
    Response.Write "No interests selected."
Else
    For i = 1 To selectedCount
        Response.Write Server.HTMLEncode(Request.Form("interest")(i)) & "<br>"
    Next
End If
%>

If you select ASP and HTML, the output contains two separate lines: ASP and HTML. A normal, single-choice radio group can be read directly as one string using Request.Form("choice").

When the field is missing

<%
If Request.Form("newsletter").Count = 0 Then
    Response.Write "Newsletter not selected."
Else
    Response.Write "Newsletter selected."
End If
%>

An unchecked checkbox typically is not submitted, so use an explicit missing-field test rather than expecting the text False.

Loop Through All Submitted Fields

You can iterate through the Request.QueryString or Request.Form collection to inspect the field names and values. These demonstrations are useful for learning or debugging; do not expose user inputs, authentication information, or private form submissions on a public page.

List GET values

 Copy<%
Option Explicit
Dim fieldName
For Each fieldName In Request.QueryString
    Response.Write Server.HTMLEncode(fieldName) & " = " & _
        Server.HTMLEncode(Request.QueryString(fieldName)) & "<br>"
Next
%>

List POST values

 Copy<%
Option Explicit
Dim fieldName
For Each fieldName In Request.Form
    Response.Write Server.HTMLEncode(fieldName) & " = " & _
        Server.HTMLEncode(Request.Form(fieldName)) & "<br>"
Next
%>

The For Each loop iterates the keys in a collection. Read only expected fields in real application logic; otherwise unexpected extra fields may appear in logs, output or downstream processing.

Validate and Safely Display Submitted Data

HTML controls such as required, type="email", and maxlength assist users but can be bypassed. Classic ASP should enforce the requirements again after receiving each request. Regular expressions in ASP can help when a field needs a specific format.

Check an optional age value before conversion

The following snippet treats the form value as text and checks for a whole number between 1 and 120 without converting unexpected input. This is a straightforward validation approach for a small numerical field.

 Copy<%
Option Explicit
Dim ageText, ageNumber, isValid, i, ch
ageText = Trim(Request.Form("age"))
isValid = (Len(ageText) >= 1 And Len(ageText) <= 3)
For i = 1 To Len(ageText)
    ch = Mid(ageText, i, 1)
    If ch < "0" Or ch > "9" Then isValid = False
Next
If isValid Then
    ageNumber = CInt(ageText)
    If ageNumber >= 1 And ageNumber <= 120 Then
        Response.Write "Age accepted."
    Else
        Response.Write "Enter an age from 1 to 120."
    End If
Else
    Response.Write "Enter whole-number digits only."
End If
%>

Why this matters: IsNumeric() may accept formats such as decimals or notation that you do not want in a whole-number field. A tighter rule prevents surprising conversions. The specific validation method should reflect the application’s input requirements.

Output encoding, database safety and request handling

• HTML output: Use Server.HTMLEncode(value) when a submitted value is displayed as HTML text. HTML encoding alone does not make data safe for SQL, JavaScript or URLs.
• SQL queries: Use parameters for SQL values; never build SQL by adding untrusted text to a command. Related tutorials include database connections and SELECT queries.
• HTTP method: Use GET for reading data and POST for actions that change information. Also check authorization and use CSRF protection for state-changing forms.
• HTTPS: POST values are not displayed in the URL, but encryption requires HTTPS. Do not output passwords or tokens in debugging pages.
• Server limits: Forms and URLs are subject to server configuration limits. File uploads require specialized handling and are not covered by ordinary text-field examples.
• Feedback: Show specific error messages when a required field is empty or invalid so users know what to correct.

For reference, Microsoft documents the Classic ASP Request.Form collection, including how to access multiple submitted values.

Common Errors and Troubleshooting

Frequently Asked Questions

What is the difference between Request.Form and Request.QueryString?

Request.Form() reads submitted form-body values, usually from POST forms. Request.QueryString() reads values in the URL query string, usually from GET forms.

Can I use Request("name") instead?

Classic ASP supports an unqualified Request("name") lookup, but it can consult more than one request collection. Explicit Request.Form("name") or Request.QueryString("name") makes the input source clearer and avoids ambiguous field names.

How do I receive multiple checkbox selections?

Give related checkboxes the same name, then iterate from 1 through Request.Form("name").Count. Read each value with Request.Form("name")(i).

Should I use POST for login and password forms?

Use POST over HTTPS, with secure authentication and server-side controls. POST keeps the password out of the query string but does not by itself encrypt, validate or safely store the password.

Can I show and process a form with one ASP file?

Yes. Submit the form to its own .asp filename, check Request.ServerVariables("REQUEST_METHOD"), then handle the posted fields. The single-file example above demonstrates this.

Why do I need Server.HTMLEncode()?

User-submitted text can contain HTML-special characters. HTML encoding lets the browser display those characters as text when rendered in the HTML context, rather than treating them as markup.

Back to top ↑

Subhendu Mohapatra

Author & Instructor at plus2net

I write and maintain practical tutorials on Python, PHP, SQL, JavaScript, HTML, jQuery, and web development at plus2net. The tutorials focus on clear explanations, working examples, and code that readers can test and adapt while learning.

About the author   Watch on YouTube

Connect: