Should be able to not use qs for urlencoded parsing

[dougwilson]

It's too bad using qs is the default, but at least we should provide an option to use something else like querystring that can parse flat to reduce the attack surface of applications. This would let users parse with urlencoded and not have to handle complex values.

[jonathanong]

i would rather have querystring be default and qs be an option, but that was break backwards compatibility.

[dougwilson]

i would rather have querystring be default and qs be an option

me too

but that was break backwards compatibility.

yep, but we can just switch it at the next major :D

[callmewa]

When will npm reflect this change?

[dougwilson]

Probably later today. I don't like to rush out a release too quickly because next thing I know I realize something I forgot and it quickly leads to a second patch release :)

Anyway, after the release (which will be 1.3.0) you will need to parse with app.use(bodyParser.urlencoded({ extended: false }))

[dougwilson]

@callmewa I published it

[callmewa]

thanks Doug!

On Sat, May 31, 2014 at 3:58 PM, Douglas Christopher Wilson <
notifications@github.com> wrote:

@callmewa https://github.com/callmewa I published it

—
Reply to this email directly or view it on GitHub
#19 (comment)
.