net/http: clarify the precedence order for Request.FormValue

Fixes #64575

Change-Id: I0eaec642a9dc8ae3b273a6d41131cc7cb8332947
GitHub-Last-Rev: 17aa5170cbfe42cb86d56f1804266850d33c3eb5
GitHub-Pull-Request: golang/go#64578
Reviewed-on: https://go-review.googlesource.com/c/go/+/547855
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Auto-Submit: Damien Neil <dneil@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

diff --git a/src/net/http/request.go b/src/net/http/request.go
index fce2d16f956424cca3a7958e37262898e7abec0c..730f51287acac6a43ceb927ee21107f6b39ce814 100644 (file)
--- a/src/net/http/request.go
+++ b/src/net/http/request.go
@@ -1378,7 +1378,11 @@ func (r *Request) ParseMultipartForm(maxMemory int64) error {
 }
 
 // FormValue returns the first value for the named component of the query.
-// POST, PUT, and PATCH body parameters take precedence over URL query string values.
+// The precedence order:
+//  1. application/x-www-form-urlencoded form body (POST, PUT, PATCH only)
+//  2. query parameters (always)
+//  3. multipart/form-data form body (always)
+//
 // FormValue calls ParseMultipartForm and ParseForm if necessary and ignores
 // any errors returned by these functions.
 // If key is not present, FormValue returns the empty string.