830

Here is my simple form:

<form id="loginformA" action="userlogin" method="post">
    <div>
        <label for="email">Email: </label>
        <input type="text" id="email" name="email"></input>
    </div>
<input type="submit" value="Submit"></input>
</form>

Here is my Express.js/Node.js code:

app.post('/userlogin', function(sReq, sRes){    
    var email = sReq.query.email.;   
}

I tried sReq.query.email or sReq.query['email'] or sReq.params['email'], etc. None of them work. They all return undefined.

When I change to a Get call, it works, so .. any idea?

Evert
  • 75,014
  • 17
  • 95
  • 156
murvinlai
  • 43,517
  • 50
  • 120
  • 169
  • 37
    **SECURITY**: everybody using `bodyParser()` from answers here should also read [@SeanLynch 's answer below](http://stackoverflow.com/a/20132867/137626) – FelipeAls Nov 24 '13 at 20:06
  • Use the [body-parser](https://www.npmjs.com/package/body-parser) module. Here are some [usful usage examples for body-parser](https://www.codota.com/code/javascript/modules/body-parser) – drorw Apr 18 '19 at 20:21

23 Answers23

1307

Things have changed once again starting Express 4.16.0, you can now use express.json() and express.urlencoded() just like in Express 3.0.

This was different starting Express 4.0 to 4.15:

$ npm install --save body-parser

and then:

var bodyParser = require('body-parser')
app.use( bodyParser.json() );       // to support JSON-encoded bodies
app.use(bodyParser.urlencoded({     // to support URL-encoded bodies
  extended: true
})); 

The rest is like in Express 3.0:

Firstly you need to add some middleware to parse the post data of the body.

Add one or both of the following lines of code:

app.use(express.json());       // to support JSON-encoded bodies
app.use(express.urlencoded()); // to support URL-encoded bodies

Then, in your handler, use the req.body object:

// assuming POST: name=foo&color=red            <-- URL encoding
//
// or       POST: {"name":"foo","color":"red"}  <-- JSON encoding

app.post('/test-page', function(req, res) {
    var name = req.body.name,
        color = req.body.color;
    // ...
});

Note that the use of express.bodyParser() is not recommended.

app.use(express.bodyParser());

...is equivalent to:

app.use(express.json());
app.use(express.urlencoded());
app.use(express.multipart());

Security concerns exist with express.multipart(), and so it is better to explicitly add support for the specific encoding type(s) you require. If you do need multipart encoding (to support uploading files for example) then you should read this.

Drew Noakes
  • 266,361
  • 143
  • 616
  • 705
  • 81
    If this answer isn't working right, make sure you have the `content-type` header set, for example: `curl -d '{"good_food":["pizza"]}' -H 'content-type:application/json' "http://www.example.com/your_endpoint"` – SooDesuNe Sep 16 '12 at 23:21
  • 6
    what is the difference between posting a form with name/value pairs and posting a JSON body? Do they both show up in req.body? – chovy Sep 23 '12 at 06:32
  • 8
    @chovy Yes, they do. `bodyParser` abstracts JSON, URL-encoded and multipart data into the `req.body` object. – Kristján Jan 10 '13 at 06:46
  • express.json() etc. are part of connect, not express, so, middlewars are should be referenced by connect.middelwarename instead of express.middleware – Konstantin Isaev Apr 14 '14 at 14:10
  • 7
    This code gave me errors as middleware is no longer bundled with Express; you'll have to use body-parser: https://github.com/senchalabs/connect#middleware – araneae Jun 13 '14 at 14:00
  • `app.use(bodyParser.urlencoded({ extended: true }));` works without error – Fabien Sa Aug 12 '14 at 16:28
  • 1
    hats off to you! I just wasted a whole day figuring what was wrong. – Adnan Nov 08 '14 at 14:39
  • 11
    For reading json using Express 4, only the `app.use(require('body-parser').json())` line is sufficient. And then you can read the json data from your request's body object, i.e. `req.body`, from within a route definition. – Martin Carel Nov 15 '14 at 21:58
  • 2
    I'm trying to understand why `JSON.parse('{'+params.split('=') .join(':') .split('&') .join(',')+'}');` needed to be its own separate middleware component rather than something Express.js just does out of the box. How is sifting through now dozens of dependencies to make the simplest things happen any easier than just using http.listen? – Erik Reppen Nov 21 '14 at 03:28
  • 2
    You're already telling express what to use. Omit the following and it'll work just fine. app.use(express.json()); // to support JSON-encoded bodies app.use(express.urlencoded()); // to support URL-encoded bodies –  Dec 23 '14 at 11:58
99

Security concern using express.bodyParser()

While all the other answers currently recommend using the express.bodyParser() middleware, this is actually a wrapper around the express.json(), express.urlencoded(), and express.multipart() middlewares (http://expressjs.com/api.html#bodyParser). The parsing of form request bodies is done by the express.urlencoded() middleware and is all that you need to expose your form data on req.body object.

Due to a security concern with how express.multipart()/connect.multipart() creates temporary files for all uploaded files (and are not garbage collected), it is now recommended not to use the express.bodyParser() wrapper but instead use only the middlewares you need.

Note: connect.bodyParser() will soon be updated to only include urlencoded and json when Connect 3.0 is released (which Express extends).


So in short, instead of ...

app.use(express.bodyParser());

...you should use

app.use(express.urlencoded());
app.use(express.json());      // if needed

and if/when you need to handle multipart forms (file uploads), use a third party library or middleware such as multiparty, busboy, dicer, etc.

Sean Lynch
  • 5,707
  • 1
  • 40
  • 45
  • Added a comment below question so more people see your concerns and advice. Would other solutions detailed in [Andrew Kelley blog post](http://andrewkelley.me/post/do-not-use-bodyparser-with-express-js.html) (still) relevant in your opinion? (just asking for others, my needs are purely for internal tools ^^) – FelipeAls Nov 24 '13 at 20:14
  • @FelipeAls - Yes, and I meant to reference Andrew's post as well. Any of those suggestions (taking into consideration the downfalls of each) are relevant. – Sean Lynch Nov 26 '13 at 01:58
  • Also, once Connect 3.0 is released without including `multipart()` as part of `bodyParser()`, `bodyParser()` becomes "safe" again, but you will need to explicitly enable multipart support using a third party library. – Sean Lynch Nov 26 '13 at 01:59
86

Note: this answer is for Express 2. See here for Express 3.

If you're using connect/express, you should use the bodyParser middleware: It's described in the Expressjs guide.

// example using express.js:
var express = require('express')
  , app = express.createServer();
app.use(express.bodyParser());
app.post('/', function(req, res){
  var email = req.param('email', null);  // second parameter is default
});

Here's the original connect-only version:

// example using just connect
var connect = require('connect');
var url = require('url');
var qs = require('qs');
var server = connect(
  connect.bodyParser(),
  connect.router(function(app) {
    app.post('/userlogin', function(req, res) {
      // the bodyParser puts the parsed request in req.body.
      var parsedUrl = qs.parse(url.parse(req.url).query);
      var email = parsedUrl.email || req.body.email;;
    });
  })
);

Both the querystring and body are parsed using Rails-style parameter handling (qs) rather than the low-level querystring library. In order to parse repeated parameters with qs, the parameter needs to have brackets: name[]=val1&name[]=val2. It also supports nested maps. In addition to parsing HTML form submissions, the bodyParser can parse JSON requests automatically.

Edit: I read up on express.js and modified my answer to be more natural to users of Express.

Community
  • 1
  • 1
yonran
  • 15,964
  • 7
  • 60
  • 81
  • Hmm ok. i try the bodyParser(). the doc says i can get it from req.query() but i got nothing. that's very weird. I have no problem with Get tho. – murvinlai Apr 19 '11 at 05:19
  • 3
    No, req.query is ONLY the GET params. You get the POST data through req.body. The function req.params() includes them both. – yonran Apr 19 '11 at 06:23
  • 1
    A stray click downvoted this answer accidentally without me noticing! Now StackOverflow won't let me change it. Esp. frustrating as this was helpful...I upvoted another of your good answers that I wasn't explicitly looking for to make up for it. :) – HostileFork says dont trust SE Apr 11 '12 at 20:58
38

This will do it if you want to build the posted query without middleware:

app.post("/register/",function(req,res){
    var bodyStr = '';
    req.on("data",function(chunk){
        bodyStr += chunk.toString();
    });
    req.on("end",function(){
        res.send(bodyStr);
    });

});

That will send this to the browser

email=emailval&password1=pass1val&password2=pass2val

It's probably better to use middleware though so you don't have to write this over and over in each route.

Peter Mortensen
  • 28,342
  • 21
  • 95
  • 123
med116
  • 1,384
  • 16
  • 15
  • 3
    sooo.... handy, for those that don't want to rely on a library that will sooner or later be deprecated – Daniel May 04 '16 at 16:55
  • you could easily build your own middleware – maioman Oct 27 '16 at 10:44
  • This is a great answer but why there is extra text "----------------------------359856253150893337905494 Content-Disposition: form-data; name="fullName" Ram ----------------------------359856253150893337905494--" I don't want that number. – Nawaraj Aug 31 '19 at 12:18
26

Note for Express 4 users:

If you try and put app.use(express.bodyParser()); into your app, you'll get the following error when you try to start your Express server:

Error: Most middleware (like bodyParser) is no longer bundled with Express and must be installed separately. Please see https://github.com/senchalabs/connect#middleware.

You'll have to install the package body-parser separately from npm, then use something like the following (example taken from the GitHub page):

var express    = require('express');
var bodyParser = require('body-parser');

var app = express();

app.use(bodyParser());

app.use(function (req, res, next) {
  console.log(req.body) // populated!
  next();
})
mplewis
  • 440
  • 1
  • 10
  • 18
  • Thanks very much for this information. Was pulling my hair out trying to deal with the new way of using bodyParser! This was a big breakthrough - really appreciate – Tommy May 27 '14 at 11:27
  • 1
    heplp: body-parser deprecated bodyParser: use individual json/urlencoded middlewares – Mohammad Faizan khan Oct 29 '14 at 06:12
20

Backend:

import express from 'express';
import bodyParser from 'body-parser';

const app = express();
app.use(bodyParser.json()); // add a middleware (so that express can parse request.body's json)

app.post('/api/courses', (request, response) => {
  response.json(request.body);
});

Frontend:

fetch("/api/courses", {
  method: 'POST',
  body: JSON.stringify({ hi: 'hello' }), // convert Js object to a string
  headers: new Headers({ "Content-Type": "application/json" }) // add headers
});
lakesare
  • 9,453
  • 5
  • 51
  • 65
20

Given some form:

<form action='/somepath' method='post'>
   <input type='text' name='name'></input>
</form>

Using express

app.post('/somepath', function(req, res) {

    console.log(JSON.stringify(req.body));

    console.log('req.body.name', req.body['name']);
});

Output:

{"name":"x","description":"x"}
req.param.name x
David
  • 599
  • 5
  • 5
16
app.use(express.bodyParser());

Then for app.post request you can get post values via req.body.{post request variable}.

Drew Noakes
  • 266,361
  • 143
  • 616
  • 705
15

Update for Express 4.4.1

Middleware of the following is removed from Express.

  • bodyParser
  • json
  • urlencoded
  • multipart

When you use the middleware directly like you did in express 3.0. You will get the following error:

Error: Most middleware (like urlencoded) is no longer bundled with Express and 
must be installed separately.


In order to utilize those middleware, now you need to do npm for each middleware separately.

Since bodyParser is marked as deprecated, so I recommend the following way using json, urlencode and multipart parser like formidable, connect-multiparty. (Multipart middleware is deprecated as well).

Also remember, just defining urlencode + json, the form data will not be parsed and req.body will be undefined. You need to define a middleware handle the multipart request.

var urlencode = require('urlencode');
var json = require('json-middleware');
var multipart = require('connect-multiparty');
var multipartMiddleware = multipart();

app.use(json);
app.use(urlencode);
app.use('/url/that/accepts/form-data', multipartMiddleware);
Nick
  • 1,403
  • 1
  • 12
  • 21
yeelan
  • 1,243
  • 1
  • 14
  • 20
8

For Express 4.1 and above

As most of the answers are using to Express, bodyParser, connect; where multipart is deprecated. There is a secure way to send post multipart objects easily.

Multer can be used as replacement for connect.multipart().

To install the package

$ npm install multer

Load it in your app:

var multer = require('multer');

And then, add it in the middleware stack along with the other form parsing middleware.

app.use(express.json());
app.use(express.urlencoded());
app.use(multer({ dest: './uploads/' }));

connect.json() handles application/json

connect.urlencoded() handles application/x-www-form-urlencoded

multer() handles multipart/form-data

Lalit Umbarkar
  • 413
  • 7
  • 13
8

I was searching for this exact problem. I was following all the advice above but req.body was still returning an empty object {}. In my case, it was something just as simple as the html being incorrect.

In your form's html, make sure you use the 'name' attribute in your input tags, not just 'id'. Otherwise, nothing is parsed.

<input id='foo' type='text' value='1'/>             // req = {}
<input id='foo' type='text' name='foo' value='1' /> // req = {foo:1}

My idiot mistake is your benefit.

cwingrav
  • 791
  • 8
  • 10
8

Update

As of Express version 4.16+, their own body-parser implementation is now included in the default Express package so there is no need for you to download another dependency.

You may have added a line to your code that looks like the following:

app.use(bodyparser.json()); //utilizes the body-parser package

If you are using Express 4.16+ you can now replace that line with:

app.use(express.json()); //Used to parse JSON bodies

This should not introduce any breaking changes into your applications since the code in express.json() is based on bodyparser.json().

If you also have the following code in your environment:

app.use(bodyParser.urlencoded({extended: true}));

You can replace that with:

app.use(express.urlencoded()); //Parse URL-encoded bodies

A final note of caution: There are still some very specific cases where body-parser might still be necessary but for the most part Express’ implementation of body-parser is all you will need for the majority of use cases.

(See the docs at expressjs/bodyparser for more details).

Shivam Jha
  • 1,204
  • 7
  • 23
7

You shoudn't use app.use(express.bodyParser()). BodyParser is a union of json + urlencoded + mulitpart. You shoudn't use this because multipart will be removed in connect 3.0.

To resolve that, you can do this:

app.use(express.json());
app.use(express.urlencoded());

It´s very important know that app.use(app.router) should be used after the json and urlencoded, otherwise it does not work!

HenioJR
  • 554
  • 1
  • 8
  • 15
5

Written at Express version 4.16

Inside the router function you can use req.body property to access the post variable. For example if this was the POST route of your form, it would send back what you input:

function(req,res){
      res.send(req.body);

      //req.body.email would correspond with the HTML <input name="email"/>
}

P.S. for those who are familiar with PHP: In order to access PHP's $_GET variable we use req.query and to access PHP's $_POST variable we use req.body in Node.js.

Logan
  • 9,611
  • 12
  • 38
  • 50
4

Request streaming worked for me

req.on('end', function() {
    var paramstring = postdata.split("&");
});

var postdata = "";
req.on('data', function(postdataChunk){
    postdata += postdataChunk;
});
zeah
  • 204
  • 3
  • 6
  • 1
    Better than doing `postdata.split("&")` would be to load core module `querystring = require('querystring')` and then parse your `postdata` with `querystring.parse(postdata)`; – John Slegers Jan 07 '16 at 01:09
4

I could find all parameters by using following code for both POST and GET requests.

var express = require('express');
var app = express();
const util = require('util');
app.post('/', function (req, res) {
    console.log("Got a POST request for the homepage");
    res.send(util.inspect(req.query,false,null));
})
Max Base
  • 533
  • 1
  • 5
  • 12
ARUNBALAN NV
  • 1,517
  • 4
  • 14
  • 37
2

Express v4.17.0

app.use(express.urlencoded( {extended: true} ))

app.post('/userlogin', (req, res) => {    

   console.log(req.body) // object

   var email = req.body.email;

}

Demo Form

Another Answer Related

antelove
  • 2,039
  • 16
  • 14
1

Post Parameters can be retrieved as follows:

app.post('/api/v1/test',Testfunction);
http.createServer(app).listen(port, function(){
    console.log("Express server listening on port " + port)
});

function Testfunction(request,response,next) {
   console.log(request.param("val1"));
   response.send('HI');
}
Max Base
  • 533
  • 1
  • 5
  • 12
HamidKhan
  • 447
  • 6
  • 8
  • 2
    do you realize this won't work ? `param` is used for GET requests.. not POST and your example lacks of details, very confusing for new comers. And on top of that `request.param` is actually deprecated, so your example is wrong on so many levels. – vdegenne Apr 14 '18 at 09:09
1
var express        =         require("express");
var bodyParser     =         require("body-parser");
var app            =         express();

app.use(bodyParser.urlencoded({ extended: false }));
app.use(bodyParser.json());

app.get('/',function(req,res){
  res.sendfile("index.html");
});
app.post('/login',function(req,res){
  var user_name=req.body.user;
  var password=req.body.password;
  console.log("User name = "+user_name+", password is "+password);
  res.end("yes");
});
app.listen(3000,function(){
  console.log("Started on PORT 3000");
})
seme
  • 87
  • 1
  • 2
0

Use express-fileupload package:

var app = require('express')();
var http = require('http').Server(app);
const fileUpload = require('express-fileupload')

app.use(fileUpload());

app.post('/', function(req, res) {
  var email = req.body.email;
  res.send('<h1>Email :</h1> '+email);
});

http.listen(3000, function(){
  console.log('Running Port:3000');
});
Max Base
  • 533
  • 1
  • 5
  • 12
Chirag
  • 303
  • 1
  • 8
0

You are using req.query.post with wrong method req.query.post works with method=get, method=post works with body-parser.

Just try this by changing post to get :

<form id="loginformA" action="userlogin" method="get">
<div>
    <label for="email">Email: </label>
    <input type="text" id="email" name="email"></input>
</div>
<input type="submit" value="Submit"></input>  
</form>

And in express code use 'app.get'

Max Base
  • 533
  • 1
  • 5
  • 12
  • There are a number of reasons to use `POST` instead of `GET`- security and data size are right out in front - so this is not an apt approach. – StephenBoesch Aug 07 '20 at 11:18
0

from official doc version 4

const express = require('express')
const app = express()
app.use(express.json());
app.use(express.urlencoded({ extended: true })) 

app.post('/push/send', (request, response) => {
  console.log(request.body)
})
AID
  • 29
  • 4
-1

when you are using POST method in HTML forms, you need to catch the data from req.body in the server side i.e. Node.js. and also add

var bodyParser = require('body-parser')
app.use( bodyParser.json() );    
app.use(bodyParser.urlencoded({extended: false}));

OR

use method='GET' in HTML and and catch the data by req.query in the server side i.e. Node.js