Do browsers preserve order of inputs with same name on GET/POST?
Yes, they should be sent in the order they appear according to the html rfc
See 8.2.1. The form-urlencoded Media Type:
The fields are listed in the order they appear in the document with the name separated from the value by
=
and the pairs separated from each other by&
. Fields with null values may be omitted. In particular, unselected radio buttons and checkboxes should not appear in the encoded data, but hidden fields with VALUE attributes present should.
I've found in the spec for html 4.0 too:
For url encoded data:
The control names/values are listed in the order they appear in the document. The name is separated from the value by
=
and name/value pairs are separated from each other by&
.
For multipart data (thanks @Chuck):
A "multipart/form-data" message contains a series of parts, each representing a successful control. The parts are sent to the processing agent in the same order the corresponding controls appear in the document stream. Part boundaries should not occur in any of the data; how this is done lies outside the scope of this specification.
The HTML5 spec for application/x-www-form-urlencoded
and text/plain
lays out an algorithm that "For each entry in the form data set [...] Append", resulting in the same order.
As for multipart/form-data
: "The order of parts must be the same as the order of fields in the form data set. Multiple entries with the same name must be treated as distinct fields."
This would not be complete without obtaining order of the form data set as derived from the document: the same spec defines an algorithm for constructing the form data set that "Loop: For each element field in controls, in tree order, run the following substeps and only skip or Append an entry.
Therefore for HTML5-compliant user agents, whatever the encoding, the non-skipped parameters are tree-ordered, with duplicates allowed.