I have read (in some spec, long ago) that web browsers may return fields in any order, which means the order of the CGI parameters *is* arbitrary. I can't find where I saw this, though.

Update:

If what I said was once the case, it is no longer. Quoting HTML docs (emphasis is mine):

The control names/values are listed in the order they appear in the document. The name is separated from the value by `=' and name/value pairs are separated from each other by `&'.

So halley is correct. HTTP clients and HTTP proxies should consider ...?joe=1&jack=2 and ...?jack=2&joe=1 to be different. (HTTP servers can do whatever they want, of course.)