Query String Parser

PSR-15 middleware that parses query strings following the OpenAPI 3.0 serialization spec.

PHP's parse_str() silently overwrites duplicate keys (?id=1&id=2 → only id=2 survives). This middleware fixes that and adds full support for OpenAPI serialization styles.

Note: We do not rewrite the URI. The original query, headers, paths, cookies, and other params are preserved in the request's attributes, we only set the parsed query parameters. This is important because some middleware may rely on the raw URI for logging, HMAC signature validation, cache-key generation, etc.

Install

composer require kdubuc/query-string-parser

Usage

$middleware = new \Kdubuc\Middleware\QueryStringParser(
    urlEncoding: PHP_QUERY_RFC1738,
    style: 'form',
    explode: true,
);

Parameters

Parameter	Type	Default	Description
$urlEncoding	int|false	PHP_QUERY_RFC1738	Decoding applied to keys and values. PHP_QUERY_RFC1738 (+ → space), PHP_QUERY_RFC3986 (%20 only), or false (no decoding).
$style	string	'form'	OpenAPI serialization style. See table below.
$explode	bool	true	When true, each value is a distinct key=value pair. When false, multiple values are packed into a single parameter using a delimiter.

Serialization styles

Follows the OpenAPI 3.0 query parameter serialization rules:

style	explode	Array id = [3,4,5]	Object id = {role:admin, firstName:Alex}
form (default)	true (default)	?id=3&id=4&id=5	?role=admin&firstName=Alex
form	false	?id=3,4,5	?id=role,admin,firstName,Alex
spaceDelimited	true	?id=3&id=4&id=5	—
spaceDelimited	false	?id=3%204%205	—
pipeDelimited	true	?id=3&id=4&id=5	—
pipeDelimited	false	?id=3|4|5	—
deepObject	true	—	?id[role]=admin&id[firstName]=Alex

Testing

composer run tests

Contributing

Please see CONTRIBUTING for details.

Security

If you discover any security related issues, please email kevindubuc62@gmail.com instead of using the issue tracker.

Credits

• Kévin DUBUC
• All Contributors

License

The CeCILL-B License. Please see License File for more information.