Read Query String Parameters in Django

Recommended preparation: set up a Django project and read the Django tutorial overview before trying the code.

A query string appears after the ? in a URL, such as /students/search/?id=10&name=Alex. Django makes these values available through request.GET.

views.py — read two optional query parameters

 Copyfrom django.http import HttpResponse

def my_data(request):
    student_id = request.GET.get("id", "Not available")
    name = request.GET.get("name", "Not available")
    return HttpResponse(f"ID: {student_id}; Name: {name}")

Try http://127.0.0.1:8000/my_app/student/my_data/?id=10&name=Alex%20Ron after configuring the URL. The %20 represents a space in the query string.

Add a named URL route

my_app/urls.py

 Copyfrom django.urls import path
from . import views

urlpatterns = [
    path("student/my_data/", views.my_data, name="my_data"),
]

The browser URL should match the project/app prefixes you configure in urls.py. Query parameters are not part of the route pattern; Django separates them automatically.

Display query values safely in a template

my_app/views.py

 Copyfrom django.shortcuts import render

def my_data(request):
    context = {
        "student_id": request.GET.get("id", "Not available"),
        "name": request.GET.get("name", "Not available"),
    }
    return render(request, "my_data.html", context)

my_app/templates/my_data.html

 Copy<!DOCTYPE html>
<html lang="en"><body>
  <p>Student ID: {{ student_id }}</p>
  <p>Student name: {{ name }}</p>
</body></html>

Django automatically HTML-escapes ordinary template variables. Avoid returning unchecked query input inside an HTML string built with mark_safe() or unsafe formatting.

Validate integer IDs

Reject non-numeric id values before using them

 Copyfrom django.http import HttpResponseBadRequest
from django.shortcuts import render

def my_data(request):
    raw_id = request.GET.get("id", "")
    try:
        student_id = int(raw_id)
    except ValueError:
        return HttpResponseBadRequest("Provide a numeric id")
    return render(request, "my_data.html", {"student_id": student_id})

For database records, prefer the ID as a typed URL path parameter and call get_object_or_404. An integer query value does not by itself prove the record exists or that the current user may view it.

Read repeated query parameters

getlist() returns all values for a repeated key

 Copy# Example URL: /search/?tag=python&tag=django
from django.http import JsonResponse

def tags(request):
    selected = request.GET.getlist("tag")
    return JsonResponse({"tags": selected})

Expected output

{"tags": ["python", "django"]}

Generate a query string safely

Python standard library

 Copyfrom urllib.parse import urlencode

params = {"id": 10, "name": "Alex Ron"}
print(urlencode(params))

Expected output

id=10&name=Alex+Ron

Do not manually concatenate user-entered values to build URLs. urlencode() escapes spaces and reserved characters correctly.

Common errors and safe use

• KeyError: use .get() for an optional parameter instead of indexing directly.
• Multiple keys: use .getlist() when the same name may appear more than once.
• Incorrect numeric comparison: query values are strings until converted.
• Sensitive information: do not put passwords or tokens in query strings, which can appear in browser history and server logs.
• Missing template: create the file in a configured template folder.

More query-string examples

Convert an optional page number safely

 Copy# Query string: ?page=3
raw_page = request.GET.get("page", "1")
try:
    page = max(1, int(raw_page))
except ValueError:
    page = 1

Whitelist a database sort field

 Copy# Query string: ?sort=name
allowed = {"name", "mark", "id"}
requested = request.GET.get("sort", "id")
sort_field = requested if requested in allowed else "id"
students = Student.objects.order_by(sort_field)

QueryDict.urlencode() uses correct escaping

 Copyfrom django.http import QueryDict

params = QueryDict(mutable=True)
params["name"] = "Alex Ron"
params["id"] = "10"
print(params.urlencode())

Expected output

name=Alex+Ron&id=10

A template can read GET only when the request context processor is enabled

{% if request.GET.name %}
  <p>Searching for: {{ request.GET.name }}</p>
{% endif %}

For reusable code and explicit validation, prefer passing a controlled value from the view rather than relying on template access to the entire request.

Frequently asked questions

What is the difference between request.GET and request.POST?

GET contains decoded query-string parameters; POST contains ordinary HTML form body fields. Both expose QueryDict objects.

Can users change a query parameter?

Yes. Treat all query-string content as untrusted and validate it before use.

How should I pass an ID to a detail page?

Use a route such as students// and Django get_object_or_404 for the record.

Back to top ↑

Subhendu Mohapatra

Author & Instructor at plus2net

I write and maintain practical tutorials on Python, PHP, SQL, JavaScript, HTML, jQuery, and web development at plus2net. The tutorials focus on clear explanations, working examples, and code that readers can test and adapt while learning.

About the author   Watch on YouTube

Connect: