Parameters are string data values that have been submitted to the servlet from the client, usually a browser.
They may have been submitted as part of a form, or they may have come from the query string. Regardless of whether the request is a GET or a POST, they are obtained from the request in the same way.
Parameters are stored in a Map with string keys, with values composed of arrays of strings; e.g. Map<String,String>. The getParameter() method simplifies this and only returns the first entry in the value array.
Parameters are read-only data values.
Note: when performing a file upload with a multipart form, the parameters cannot be obtained from the request. They must be obtained using methods provided from whatever upload library you are using. See the FAQ entry on file uploading.
Attributes are server-side data values that your code can store and retrieve. In modern parlance, attributes are better known as scoped variables.
Scoped variables can be placed in one of three scopes: request, session or application scope (the latter is access as the ServletContext). In a JSP, a fourth scope, page scope, exists.
Scoped variables are set into a scope with the setAttribute() method, and retrieved with the getAttribute() method.
Request scope is most often used to carry data from a servlet controller to its view JSP. Any data stored in request scope is lost after the response is sent to the client.
Session scope is used to hold data over multiple requests for a specific user. Care must be take to make sure that variables placed in session scope are removed when they are no longer needed.
Application scope is used when the data to be stored must be shared by the entire web application. Application scope is obtained as the ServletContext instance.