Index: modules/resin/src/com/caucho/server/http/Form.java
===================================================================
--- modules/resin/src/com/caucho/server/http/Form.java	(revision 7826)
+++ modules/resin/src/com/caucho/server/http/Form.java	(revision )
@@ -39,6 +39,10 @@
 import java.io.InputStream;
 import java.io.UnsupportedEncodingException;
 import java.text.CharacterIterator;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.Map;
+import java.util.Set;
 import java.util.logging.Level;
 import java.util.logging.Logger;
 
@@ -71,11 +75,11 @@
   /**
    * Parses the values from a query string.
    *
-   * @param table the hashtable which will contain the results
+   * @param outerTable the hashtable which will contain the results
    * @param query the query string to evaluate
    * @param javaEncoding the Java name for the charset
    */
-  public void parseQueryString(HashMapImpl<String,String[]> table,
+  public void parseQueryString(HashMapImpl<String,String[]> outerTable,
                                String query,
                                String javaEncoding,
                                boolean isTop)
@@ -89,6 +93,8 @@
     } catch (UnsupportedEncodingException e) {
       log.log(Level.FINE, e.toString(), e);
     }
+    HashMapImpl<String,String[]> table;
+    table = isTop ? outerTable : new HashMapImpl<String, String[]>();
 
     int ch = is.current();
     while (ch != CharacterIterator.DONE) {
@@ -116,22 +122,37 @@
       
       if (key == null || key.equals("")) {
       }
-      else if (oldValue == null)
+      else if (oldValue == null) {
         table.put(key, new String[] { value });
-      else if (isTop) {
+      }
+      else {
         String []newValue = new String[oldValue.length + 1];
         System.arraycopy(oldValue, 0, newValue, 0, oldValue.length);
         newValue[oldValue.length] = value;
         table.put(key, newValue);
-      } else {
-        String []newValue = new String[oldValue.length + 1];
-        System.arraycopy(oldValue, 0, newValue, 1, oldValue.length);
-        newValue[0] = value;
-        table.put(key, newValue);
       }
     }
+    if (isTop) {
+        return;
-  }
+    }
 
+    // Merge table to outer table. This will preserve the querystring parameter order
+    Set<Map.Entry<String, String[]>> entries = table.entrySet();
+    for (Map.Entry<String, String[]> entry : entries) {
+        String []outerValues = outerTable.get(entry.getKey());
+        String []newValues;
+        if (outerValues != null) {
+            newValues = new String[outerValues.length + entry.getValue().length];
+            System.arraycopy(entry.getValue(), 0, newValues, 0, entry.getValue().length);
+            System.arraycopy(outerValues, 0, newValues, entry.getValue().length, outerValues.length);
+        }
+        else {
+            newValues = entry.getValue();
+        }
+        outerTable.put(entry.getKey(), newValues);
+    }
+  }
+
   /**
    * Scans the next character from the input stream, adding it to the
    * converter.