Last updated: August 26, 2026.
The ASP Request object reads query strings, form fields, cookies, server variables, and uploaded request data.
Read and validate input
<%
Dim pageNumber, searchText
searchText = Trim(Request.QueryString("q"))
If IsNumeric(Request.QueryString("page")) Then
pageNumber = CLng(Request.QueryString("page"))
Else
pageNumber = 1
End If
If pageNumber < 1 Or pageNumber > 1000 Then pageNumber = 1
Response.Write Server.HTMLEncode(searchText)
%>Collections
| Collection | Contains |
|---|---|
QueryString | URL query parameters |
Form | Form-urlencoded POST fields |
Cookies | Request cookies |
ServerVariables | Server and HTTP request metadata |
ClientCertificate | Client-certificate data when configured |
Treat every request value as untrusted. Validate type, length, range, and allowed values; then encode for the output context or bind as a database parameter.
