LearnAI ToolsCareerPractice BuildsPlayContact
Lesson 1420 min read

Forms & Request Handling

Build an HTML form that submits to a JSP, and learn how to read request parameters safely using getParameter and JSTL.

Introduction

So far every value on the page has come from an attribute a servlet placed there. Most real applications also need to go the other way: a user fills out an HTML form, submits it, and the server reads that input to do something useful — search, log in, save a record. This lesson covers the classic JSP request/response cycle: an HTML form, the JSP or servlet that receives it, and the two ways to read submitted data.

What You Will Learn
  • How to build an HTML form that submits to a JSP.
  • How to read form fields with request.getParameter().
  • How to read the same fields declaratively with EL's param object.
  • The practical difference between GET and POST submissions.

Building the Form

A standard HTML form needs an action pointing at the target JSP and a method. Each input's name attribute becomes the parameter name the server will read.

register.jsp
<!-- register.jsp -->
<form action="welcome.jsp" method="post">
    <label for="username">Username:</label>
    <input type="text" id="username" name="username" required />


    <label for="email">Email:</label>
    <input type="email" id="email" name="email" required />


    <label for="age">Age:</label>
    <input type="number" id="age" name="age" min="1" />


    <button type="submit">Register</button>
</form>

Reading Parameters in Java

On the receiving page, every field is available through the implicit request object's getParameter() method. The return type is always String, or null if the field was never submitted.

welcome.jsp (scriptlet style)
<%
    String username = request.getParameter("username");
    String email = request.getParameter("email");
    String ageParam = request.getParameter("age");
    int age = (ageParam != null && !ageParam.isEmpty()) ? Integer.parseInt(ageParam) : 0;
%>
<p>Welcome, <%= username %>! We will contact you at <%= email %>.</p>
Scriptlets Shown for Understanding Only

Reading via scriptlets like this is how JSP worked historically and is useful to recognize in legacy code. Modern JSP pages should avoid scriptlets and prefer the EL approach below, or better yet a servlet controller (covered in the MVC lesson).

Reading Parameters with EL

Expression Language exposes request parameters through the implicit param object, so a JSP-only view can read form data without a single line of Java.

welcome.jsp (EL style)
<p>Welcome, ${param.username}! We will contact you at ${param.email}.</p>
<p>Your age on file: ${param.age}</p>
Rendered Output

Click Run to see what this code prints.

GET vs POST

The method attribute controls how the browser sends the data. Both are readable identically with getParameter() or ${param.x} on the server, but they behave very differently on the wire.

AspectGETPOST
Data locationAppended to the URL as a query stringSent in the request body
VisibilityVisible in browser history and server logsNot shown in the URL
Size limitLimited by URL lengthEffectively unlimited (server-configured)
Typical useSearch forms, filters, bookmarkable pagesLogins, registrations, sensitive data
IdempotentYes — safe to repeatNo — resubmitting can duplicate an action

Handling Missing Values

A user can submit a form with an empty field, or a request can arrive without a parameter at all (for example, a checkbox that was left unchecked sends no value). Always guard against null and empty strings before using a value.

Guarding Against Missing Data with JSTL
<c:choose>
    <c:when test="${empty param.email}">
        <p class="error">Email is required.</p>
    </c:when>
    <c:otherwise>
        <p>Email on file: ${param.email}</p>
    </c:otherwise>
</c:choose>
Output When email Is Missing

Click Run to see what this code prints.

Common Mistakes

Avoid These Mistakes
  • Forgetting that getParameter() always returns String, then calling Integer.parseInt() on a null and crashing with a NullPointerException.
  • Mismatching the input name attribute in the form with the name used in getParameter() — they must match exactly, case-sensitively.
  • Using GET for a login form, exposing the password in the browser history and server access logs.
  • Not trimming or validating user input before using it in business logic.

Best Practices

  • Use POST for anything that changes state or contains sensitive data.
  • Validate and sanitize every parameter before trusting it — never assume the form did the validating.
  • Prefer ${param.x} in the view and leave heavier processing to a servlet controller.
  • Give form fields clear, matching name attributes and document them if the form is complex.

Frequently Asked Questions

It returns null, not an empty string, so always null-check before further processing.

Yes, use request.getParameterValues("fieldName") which returns a String array instead of a single String.

Yes, param reads from the request regardless of the HTTP method used to submit it.

Key Takeaways

  • HTML forms send data via input name attributes to an action URL.
  • request.getParameter() reads a single form value as a String.
  • ${param.x} reads the same value declaratively in EL.
  • GET exposes data in the URL; POST hides it in the request body.

Summary

You now know both sides of a form submission: building the HTML and reading the values it sends. The next piece of the puzzle is remembering things between requests — that is what HttpSession is for, and it is the topic of the next lesson.

Next Lesson →

Session Management