title: Request.QueryString[] vs. Request.Query.Get() vs. HttpUtility.ParseQueryString()
body: <p>I searched SO and found similar questions, but none compared all three.  That surprised me, so if someone knows of one, please point me to it.</p>
  
  <p>There are a number of different ways to parse the query string of a request... the "correct" way (IMO) should handle null/missing values, but also decode parameter values as appropriate.  Which of the following would be the best way to do both?</p>
  
  <p><br />
  <strong>Method 1</strong> </p>
  
  <pre><code>string suffix = Request.QueryString.Get("suffix") ?? "DefaultSuffix";
  </code></pre>
  
  <p><br />
  <strong>Method2</strong></p>
  
  <pre><code>string suffix = Request.QueryString["suffix"] ?? "DefaultSuffix";
  </code></pre>
  
  <p><br />
  <strong>Method 3</strong></p>
  
  <pre><code>NameValueCollection params = HttpUtility.ParseQueryString(Request.RawUrl);    
  string suffix = params.Get("suffix") ?? "DefaultSuffix";
  </code></pre>
  
  <p><br />
  <strong>Method 4</strong></p>
  
  <pre><code>NameValueCollection params = HttpUtility.ParseQueryString(Request.RawUrl);    
  string suffix = params["suffix"] ?? "DefaultSuffix";
  </code></pre>
  
  <p><br />
  Questions:</p>
  
  <ol>
  <li><p>Would <code>Request.QueryString["suffix"]</code> return a null if no suffix was specified?
  (Embarrassingly basic question, I know)</p></li>
  <li><p>Does <code>HttpUtility.ParseQueryString()</code> provide any extra functionality over accessing <code>Request.QueryString</code> directly?</p></li>
  <li><p>The MSDN documentation lists this warning:<br/>
  <br />
  <code>The ParseQueryString method uses query strings that might contain user input, which is a potential security threat. By default, ASP.NET Web pages validate that user input does not include script or HTML elements. For more information, see Script Exploits Overview.</code><br />
  <br />
  But it's not clear to me if that means <code>ParseQueryString()</code> should be used to handle that, or is exposed to security flaws because of it...  Which is it?</p></li>
  <li><p><code>ParseQueryString()</code> uses UTF8 encoding by default... do all browsers encode the query string in UTF8 by default?</p></li>
  <li><p><code>ParseQueryString()</code> will comma-separate values if more than one is specified... does <code>Request.QueryString()</code> do that as well, or what happens if it doesn't?</p></li>
  <li><p>Which of those methods would correctly decode "%2b" to be a "+"?</p></li>
  </ol>
  
  <p><br />
  Showing my Windows development roots again... and I would be a much faster developer if I didn't wonder about these things so much... : P</p>