Unfortunately, this documents only dealing with URL parameters, AKA +GET parameters. Others are invited and encouraged to contribute documentation +for POST.
+ +The relevant code is in "url.lisp"
+ +To obtain all parameters, use URL-QUERY-ALIST
++(defmethod handle-request-response ((handler my-handler) method request) + ; let's say the request is "http://example.com/my/handler?foo=1;bar=12" + (let ((params (url-query-alist (request-url request)))) + insert-code-here)) ++ +
Params would now look like: +
+'(("foo" "1")("bar" "12"))
+
+
+To improve clarity in your code, or because you just want one or two parameters, +consider using URL-QUERY-PARAM
++(defmethod handle-request-response ((handler my-handler) method request) + ; let's say the request is "http://example.com/my/handler?foo=1;bar=12" + (let ((foo (url-query-param (request-url request) "foo")) + (bar (url-query-param (request-url request) "bar"))) + insert-code-here)) ++ +
It's important to note that the values will be returned as strings.
+ +If you pass :case-sensitive f to URL-QUERY-PARAM, the key will be matched without +regard to case. This is best to use when you can.
+ + +To help prevent errors (and help close some security holes), the above functions +have tainted equivalents. CL-TAINT is a package developed by Alan Shields and is included +with Araneida. Taint wraps a value in a lambda, preventing it from being used directly - +you must untaint it first. + +
+CL-USER> (setf x "5")
+"5"
+CL-USER> x
+"5"
+CL-USER> (setf y (taint "5"))
+#<CLOSURE (LAMBDA ()) {5082C97D}>
+CL-USER> y
+#<CLOSURE (LAMBDA ()) {5082C97D}>
+CL-USER> (untaint #'parse-integer y)
+5
+
+
+By defining your own untainting functions, you can make sure that only proper values are +used. + +
The tainted versions are TAINTED-URL-QUERY-ALIST and TAINTED-URL-QUERY-PARAM. They have +the same argument list - the only difference is that the values are returned tainted. + +
If you wish to be warned when you use untainted calls, set araneida:*warn-when-using-untainted-values* +to a true value. This will cause a USING-UNTAINTED-VALUES condition (a warning) to be signaled whenever +untainted calls are used. + + + }