When ?par1=a&par1=b | Technology | Parsing Result | outcome (par1=) | | ----------------------------------------------- | ------------------------ | --------------- | | ASP.NET/IIS | All occurrences | a,b | | ASP/IIS | All occurrences | a,b | | Golang net/http - `r.URL.Query().Get("param")` | First occurrence | a | | Golang net/http - `r.URL.Query()["param"]` | All occurrences in array | ['a','b'] | | IBM HTTP Server | First occurrence | a | | IBM Lotus Domino | First occurrence | a | | JSP,Servlet/Tomcat | First occurrence | a | | mod_wsgi (Python)/Apache | First occurrence | a | | Nodejs | All occurrences | a,b | | Perl CGI/Apache | First occurrence | a | | Perl CGI/Apache | First occurrence | a | | PHP/Apache | Last occurrence | b | | PHP/Zues | Last occurrence | b | | Python Django | Last occurrence | b | | Python Flask | First occurrence | a | | Python/Zope | All occurrences in array | ['a','b'] | | Ruby on Rails | Last occurrence | b |
Source: HTTP Parameter Pollution/README.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.