> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/web-application-fundamentals/user-input-in-application.md).

# User Input in Application

## **Methods of User Input in a Web Application**

In a web application, a server can receive input from a user through two primary methods:

### **1. Header/URL Parameters**

This method involves passing input to the server via the **URL of the requested web page**. Parameters are appended to the URL using a **question mark (`?`)** to separate them from the main URL, and multiple parameters are joined using **ampersands (`&`)**.

For example, a URL with parameters may appear as follows:

```
http://example.com/page?param1=value1&param2=value2
```

In this case, the server extracts the parameters (`param1=value1` and `param2=value2`) from the URL and processes them to generate an appropriate response.

<figure><img src="/files/V84PRdeafvhXspQanLTg" alt=""><figcaption><p>Understanding URLs</p></figcaption></figure>

***

### **2. HTTP Body (Message Body)**

The **HTTP body** (or message body) is the section of an HTTP request or response that contains the actual **data being transmitted**. It is located **after the headers** in an HTTP message and is separated from them by a blank line. This method is commonly used for sending larger or structured data, such as **form submissions, JSON payloads in API requests, and file uploads**.