Yes, they should be sent in the order they appear according to the html rfc
See 8.2.1. The form-urlencoded Media Type:
The fields are listed in the order they appear in the document with the
name separated from the value by=
and the pairs separated from each
other by&. Fields with null values
may be omitted. In particular,
unselected radio buttons and
checkboxes should not appear in the
encoded data, but hidden fields with
VALUE attributes present should.
I’ve found in the spec for html 4.0 too:
For url encoded data:
The control names/values are listed in
the order they appear in the document.
The name is separated from the value
by=and name/value pairs are
separated from each other by&.
For multipart data (thanks @Chuck):
A “multipart/form-data” message
contains a series of parts, each
representing a successful control. The
parts are sent to the processing agent
in the same order the corresponding
controls appear in the document
stream. Part boundaries should not
occur in any of the data; how this is
done lies outside the scope of this
specification.