Read URL parameters in Express

Read query-string values from req.query and named route parameters from req.params. Both contain client-controlled input. Query values are not guaranteed to be single strings: their shape depends on repeated parameters and the configured query parser.

Read and validate a query string

This example explicitly selects the simple query parser, avoiding reliance on a version-specific default:

const express = require('express');
const app = express();
app.set('query parser', 'simple');

app.get('/example', (req, res) => {
  const { param1, param2 } = req.query;
  if (typeof param1 !== 'string' || typeof param2 !== 'string') {
    return res.status(400).json({ error: 'Provide param1 and param2 once each' });
  }
  return res.json({ param1, param2 });
});

app.get('/user/:id', (req, res) => {
  return res.json({ userId: req.params.id });
});
app.listen(3000);

/example?param1=hello&param2=world returns two strings. With the simple parser, repeated keys such as ?tag=a&tag=b produce an array. A custom or extended parser can return other structures; disabling parsing changes behavior again.

Keep the sources distinct

Use express.urlencoded(...) for URL-encoded form bodies or express.json() for JSON. These parsers do not replace query-string validation.

Convert numbers deliberately

A value such as ?page=2 starts as text. Reject arrays, objects, invalid numbers, and unsuitable ranges before using it:

function readPage(raw) {
  if (raw === undefined) return 1;
  if (typeof raw !== 'string' || !/^[1-9][0-9]*$/.test(raw)) return null;
  const page = Number(raw);
  return Number.isSafeInteger(page) ? page : null;
}

Return a validation error when this helper returns null. Parameterized SQL and safe APIs remain necessary after type validation; do not interpolate parameters into SQL or shell commands.

Common questions

Express's parser decodes URL escapes. Encode individual values on the client with encodeURIComponent or URLSearchParams, and check for double encoding or a wrong character encoding when text is corrupted.

req.originalUrl retains the original request URL path and query. For a standard query API, use new URL(req.originalUrl, 'http://example.invalid').searchParams; getAll('tag') returns every value. This parsing step does not contact that host.

To normalize tags from the simple parser, turn an absent value into [], a string into [value], and accept an array only after validating every member as a string. Do not blindly flatten arbitrary parser output.

Reference: Express request API.