diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 39eff1b70..b72e4e7f9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -99,6 +99,7 @@ jobs:
             container: mssql
             db_url: "mssql://root:Password123!@127.0.0.1/sqlpage"
           - database: oracle
+            test_args: --test-threads=2
             container: oracle
             db_url: "Driver=Oracle 23 ODBC driver;Dbq=//127.0.0.1:1521/FREEPDB1;Uid=root;Pwd=Password123!"
           - database: duckdb
@@ -142,7 +143,7 @@ jobs:
         run: docker compose logs ${{ matrix.container }}
       - name: Run tests against ${{ matrix.database }}
         timeout-minutes: 5
-        run: scripts/run-test-binaries.sh
+        run: scripts/run-test-binaries.sh ${{ matrix.test_args }}
         env:
           DATABASE_URL: ${{ matrix.db_url }}
           MALLOC_CHECK_: 3
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 43487637c..252c86e9d 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -96,6 +96,14 @@ export DATABASE_URL=mssql://root:Password123!@localhost/sqlpage
 cargo test
 ```
 
+Use `common::response_for(path)` for ordinary integration requests and
+`common::response_with(path, config)` for custom configuration. Custom requests use
+`common::response_from(request)`; tests sharing database or cache state use `common::send_request`.
+These helpers use the production `create_app` routes and middleware through an Actix test service,
+whose destructor drains its request pool.
+Keep `#[actix_web::test]`; standalone `TestRequest::to_srv_request()` retains application state.
+When testing Oracle locally, use `cargo test -- --test-threads=2` to avoid overwhelming the listener.
+
 ### End-to-End Tests
 
 We use Playwright for end-to-end testing of dynamic frontend features.
diff --git a/scripts/run-test-binaries.sh b/scripts/run-test-binaries.sh
index 6a02b2a77..4d0038a4d 100755
--- a/scripts/run-test-binaries.sh
+++ b/scripts/run-test-binaries.sh
@@ -13,6 +13,6 @@ fi
 
 for test_binary in "${test_binaries[@]}"; do
   echo "::group::$(basename "$test_binary")"
-  "$test_binary" --quiet
+  "$test_binary" --quiet "$@"
   echo "::endgroup::"
 done
diff --git a/src/webserver/database/sqlpage_expr.rs b/src/webserver/database/sqlpage_expr.rs
index 126a133fc..7b7ecd769 100644
--- a/src/webserver/database/sqlpage_expr.rs
+++ b/src/webserver/database/sqlpage_expr.rs
@@ -12,7 +12,6 @@ use serde_json::Value;
 use super::execute_queries::DbConn;
 use super::sqlpage_functions::functions::SqlPageFunctionName;
 use crate::webserver::http_request_info::ExecutionContext;
-use crate::webserver::single_or_vec::SingleOrVec;
 
 /// An expression evaluated by `SQLPage`.
 ///
@@ -163,50 +162,21 @@ fn value_to_sqlpage_value(value: Value) -> SqlPageValue<'static> {
 
 impl VariableRef {
     fn evaluate<'a>(&self, request: &'a ExecutionContext) -> SqlPageValue<'a> {
-        let value = match self.source {
-            VariableSource::Url => request
-                .url_params
-                .get(&self.name)
-                .map(SingleOrVec::as_json_str),
-            VariableSource::SetOrForm => {
-                if let Some(value) = request.set_variables.borrow().get(&self.name) {
-                    return value.as_ref().map_or(SqlPageValue::Null, |value| {
-                        SqlPageValue::Text(Cow::Owned(value.as_json_str().into_owned()))
-                    });
-                }
-                request
-                    .post_variables
-                    .get(&self.name)
-                    .map(SingleOrVec::as_json_str)
-            }
-            VariableSource::SetOrUrl => {
-                if let Some(value) = request.set_variables.borrow().get(&self.name) {
-                    return value.as_ref().map_or(SqlPageValue::Null, |value| {
-                        SqlPageValue::Text(Cow::Owned(value.as_json_str().into_owned()))
-                    });
-                }
-                let url_value = request.url_params.get(&self.name);
-                if request.post_variables.contains_key(&self.name) {
-                    if url_value.is_some() {
-                        log::warn!(
-                            "Deprecation warning! There is both a URL parameter named '{}' and a form field named '{}'. SQLPage is using the URL parameter for ${}. Please use :{} to reference the form field explicitly.",
-                            self.name,
-                            self.name,
-                            self.name,
-                            self.name,
-                        );
-                    } else {
-                        log::warn!(
-                            "Deprecation warning! ${} was used to reference a form field value (a POST variable). This now uses only URL parameters. Please use :{} instead.",
-                            self.name,
-                            self.name,
-                        );
-                    }
-                }
-                url_value.map(SingleOrVec::as_json_str)
-            }
+        use crate::webserver::request_variables::{LookupPolicy, VariableAccess, VariableValue};
+        let policy = match self.source {
+            VariableSource::Url => LookupPolicy::GetOnly,
+            VariableSource::SetOrForm => LookupPolicy::SetThenPost,
+            VariableSource::SetOrUrl => LookupPolicy::SetThenGet,
         };
-        value.map_or(SqlPageValue::Null, SqlPageValue::Text)
+        let variables = VariableAccess::new(
+            &request.url_params,
+            &request.post_variables,
+            &request.set_variables,
+        );
+        match variables.lookup(&self.name, policy) {
+            VariableValue::Missing | VariableValue::Null => SqlPageValue::Null,
+            VariableValue::Text(value) => SqlPageValue::Text(value),
+        }
     }
 }
 
diff --git a/src/webserver/database/sqlpage_functions/functions/variables.rs b/src/webserver/database/sqlpage_functions/functions/variables.rs
index d482b1534..8ca8aa46e 100644
--- a/src/webserver/database/sqlpage_functions/functions/variables.rs
+++ b/src/webserver/database/sqlpage_functions/functions/variables.rs
@@ -22,28 +22,11 @@ pub(super) async fn variables<'a>(
             ));
         }
     } else {
-        use serde::{Serializer, ser::SerializeMap};
-        let mut res = Vec::new();
-        let mut serializer = serde_json::Serializer::new(&mut res);
-        let set_vars = request.set_variables.borrow();
-        let len = request.url_params.len() + request.post_variables.len() + set_vars.len();
-        let mut ser = serializer.serialize_map(Some(len))?;
-        let mut seen_keys = std::collections::HashSet::new();
-        for (k, v) in &*set_vars {
-            seen_keys.insert(k);
-            ser.serialize_entry(k, v)?;
-        }
-        for (k, v) in &request.post_variables {
-            if seen_keys.insert(k) {
-                ser.serialize_entry(k, v)?;
-            }
-        }
-        for (k, v) in &request.url_params {
-            if seen_keys.insert(k) {
-                ser.serialize_entry(k, v)?;
-            }
-        }
-        ser.end()?;
-        String::from_utf8(res)?
+        let variables = crate::webserver::request_variables::VariableAccess::new(
+            &request.url_params,
+            &request.post_variables,
+            &request.set_variables,
+        );
+        serde_json::to_string(&variables)?
     })
 }
diff --git a/src/webserver/request_variables.rs b/src/webserver/request_variables.rs
index 1b73f4120..c2ca579c8 100644
--- a/src/webserver/request_variables.rs
+++ b/src/webserver/request_variables.rs
@@ -1,10 +1,95 @@
+use std::borrow::Cow;
+use std::cell::RefCell;
 use std::collections::{HashMap, hash_map::Entry};
 
+use serde::{Serialize, Serializer, ser::SerializeMap};
+
 use crate::webserver::single_or_vec::SingleOrVec;
 
 pub type ParamMap = HashMap<String, SingleOrVec>;
 pub type SetVariablesMap = HashMap<String, Option<SingleOrVec>>;
 
+/// Request values stay borrowed; mutable SET values are copied before releasing
+/// their `RefCell` borrow. A present SET NULL must suppress request fallbacks.
+pub(crate) struct VariableAccess<'a> {
+    get: &'a ParamMap,
+    post: &'a ParamMap,
+    set: &'a RefCell<SetVariablesMap>,
+}
+
+#[derive(Clone, Copy)]
+pub(crate) enum LookupPolicy {
+    GetOnly,
+    SetThenGet,
+    SetThenPost,
+}
+
+pub(crate) enum VariableValue<'a> {
+    Missing,
+    Null,
+    Text(Cow<'a, str>),
+}
+
+impl<'a> VariableAccess<'a> {
+    pub(crate) fn new(
+        get: &'a ParamMap,
+        post: &'a ParamMap,
+        set: &'a RefCell<SetVariablesMap>,
+    ) -> Self {
+        Self { get, post, set }
+    }
+
+    pub(crate) fn lookup(&self, name: &str, policy: LookupPolicy) -> VariableValue<'a> {
+        if !matches!(policy, LookupPolicy::GetOnly)
+            && let Some(value) = self.set.borrow().get(name)
+        {
+            return value.as_ref().map_or(VariableValue::Null, |value| {
+                VariableValue::Text(Cow::Owned(value.as_json_str().into_owned()))
+            });
+        }
+        let values = match policy {
+            LookupPolicy::SetThenPost => self.post,
+            LookupPolicy::GetOnly | LookupPolicy::SetThenGet => self.get,
+        };
+        if matches!(policy, LookupPolicy::SetThenGet) && self.post.contains_key(name) {
+            if values.contains_key(name) {
+                log::warn!(
+                    "Deprecation warning! There is both a URL parameter named '{name}' and a form field named '{name}'. SQLPage is using the URL parameter for ${name}. Please use :{name} to reference the form field explicitly."
+                );
+            } else {
+                log::warn!(
+                    "Deprecation warning! ${name} was used to reference a form field value (a POST variable). This now uses only URL parameters. Please use :{name} instead."
+                );
+            }
+        }
+        values.get(name).map_or(VariableValue::Missing, |value| {
+            VariableValue::Text(value.as_json_str())
+        })
+    }
+}
+
+/// Serialize the merged SET > POST > GET view without cloning its values.
+impl Serialize for VariableAccess<'_> {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        let set = self.set.borrow();
+        let mut map = serializer.serialize_map(None)?;
+        for (key, value) in &*set {
+            map.serialize_entry(key, value)?;
+        }
+        for (key, value) in self.post {
+            if !set.contains_key(key) {
+                map.serialize_entry(key, value)?;
+            }
+        }
+        for (key, value) in self.get {
+            if !set.contains_key(key) && !self.post.contains_key(key) {
+                map.serialize_entry(key, value)?;
+            }
+        }
+        map.end()
+    }
+}
+
 pub fn param_map<PAIRS: IntoIterator<Item = (String, String)>>(values: PAIRS) -> ParamMap {
     values
         .into_iter()
@@ -26,3 +111,47 @@ pub fn param_map<PAIRS: IntoIterator<Item = (String, String)>>(values: PAIRS) ->
             map
         })
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use LookupPolicy::{GetOnly, SetThenGet, SetThenPost};
+    use VariableValue::{Missing, Null, Text};
+
+    #[test]
+    fn lookup_distinguishes_null_missing_and_releases_set_borrows() {
+        let get = param_map([("value".into(), "get".into())]);
+        let post = param_map([("value".into(), "post".into())]);
+        for (policy, fallback) in [(GetOnly, "get"), (SetThenGet, "get"), (SetThenPost, "post")] {
+            let set = RefCell::new(SetVariablesMap::from([("value".into(), None)]));
+            let view = VariableAccess::new(&get, &post, &set);
+            assert!(matches!(view.lookup("absent", policy), Missing));
+            let get_only = matches!(policy, GetOnly);
+            assert_eq!(matches!(view.lookup("value", policy), Null), !get_only);
+            for (value, expected) in [
+                (SingleOrVec::Single("set".into()), "set"),
+                (
+                    SingleOrVec::Vec(vec!["a".into(), "b".into()]),
+                    r#"["a","b"]"#,
+                ),
+            ] {
+                set.borrow_mut().insert("value".into(), Some(value));
+                let Text(actual) = view.lookup("value", policy) else {
+                    panic!("missing SET")
+                };
+                if expected.starts_with('[') {
+                    assert_eq!(
+                        serde_json::to_value(&view).unwrap()["value"],
+                        serde_json::json!(["a", "b"])
+                    );
+                }
+                set.borrow_mut().clear();
+                assert_eq!(matches!(actual, Cow::Borrowed(_)), get_only);
+                assert_eq!(actual, if get_only { "get" } else { expected });
+                assert!(
+                    matches!(view.lookup("value", policy), Text(Cow::Borrowed(value)) if value == fallback)
+                );
+            }
+        }
+    }
+}
diff --git a/tests/basic/mod.rs b/tests/basic/mod.rs
index 1db6cce64..ae1623584 100644
--- a/tests/basic/mod.rs
+++ b/tests/basic/mod.rs
@@ -4,22 +4,21 @@ use actix_web::{
     test,
 };
 
-use crate::common::req_path;
+use crate::common::{response_for, response_with, test_config};
 
 #[actix_web::test]
 async fn test_index_ok() {
-    let resp = req_path("/").await.unwrap();
+    let resp = response_for("/").await;
     assert_eq!(resp.status(), http::StatusCode::OK);
-    let body = test::read_body(resp).await;
-    assert!(body.starts_with(b"<!DOCTYPE html>"));
-    let body = String::from_utf8(body.to_vec()).unwrap();
+    let body = crate::common::read_body_string(resp).await;
+    assert!(body.starts_with("<!DOCTYPE html>"));
     assert!(body.contains("It works !"));
     assert!(!body.contains("error"));
 }
 
 #[actix_web::test]
 async fn test_access_config_forbidden() {
-    let resp_result = req_path("/sqlpage/sqlpage.json").await;
+    let resp_result = response_with("/sqlpage/sqlpage.json", test_config()).await;
     assert!(
         resp_result.is_err(),
         "Accessing the config file should be forbidden, but we received a response: {resp_result:?}"
@@ -35,7 +34,7 @@ async fn test_access_config_forbidden() {
 
 #[actix_web::test]
 async fn test_static_files() {
-    let resp = req_path("/tests/it_works.txt").await.unwrap();
+    let resp = response_for("/tests/it_works.txt").await;
     assert_eq!(resp.status(), http::StatusCode::OK);
     let body = test::read_body(resp).await;
     assert_eq!(&body, &b"It works !"[..]);
@@ -43,11 +42,8 @@ async fn test_static_files() {
 
 #[actix_web::test]
 async fn test_spaces_in_file_names() {
-    let resp = req_path("/tests/core/spaces%20in%20file%20name.sql")
-        .await
-        .unwrap();
+    let resp = response_for("/tests/core/spaces%20in%20file%20name.sql").await;
     assert_eq!(resp.status(), http::StatusCode::OK);
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert!(body_str.contains("It works !"), "{body_str}");
 }
diff --git a/tests/common/mod.rs b/tests/common/mod.rs
index da2b689f0..088b99beb 100644
--- a/tests/common/mod.rs
+++ b/tests/common/mod.rs
@@ -3,10 +3,10 @@ use std::time::Duration;
 
 use actix_web::{
     App, HttpResponse, HttpServer,
-    dev::{ServiceRequest, fn_service},
+    dev::{ServiceRequest, ServiceResponse, fn_service},
     http::header,
     http::header::ContentType,
-    test::TestRequest,
+    test::{self, TestRequest},
     web,
     web::Data,
 };
@@ -14,101 +14,112 @@ use sqlpage::{
     AppState,
     app_config::{AppConfig, test_database_url},
     telemetry,
-    webserver::http::{form_config, main_handler, payload_config},
+    webserver::http::create_app,
 };
 use tokio::sync::oneshot;
 use tokio::task::JoinHandle;
 
-pub(crate) async fn get_request_to_with_data(
-    path: &str,
-    data: Data<AppState>,
-) -> actix_web::Result<TestRequest> {
-    Ok(TestRequest::get()
-        .uri(path)
+/// Builds a GET request with the defaults used by the SQL fixtures.
+pub(crate) fn request_for(path: impl AsRef<str>) -> TestRequest {
+    TestRequest::get()
+        .uri(path.as_ref())
         .insert_header(ContentType::plaintext())
         .insert_header(header::Accept::html())
-        .app_data(payload_config(&data))
-        .app_data(form_config(&data))
-        .app_data(data))
 }
 
-pub(crate) async fn get_request_to(path: &str) -> actix_web::Result<TestRequest> {
-    let data = make_app_data().await;
-    get_request_to_with_data(path, data).await
+pub(crate) fn multipart_request(path: &str, body: impl Into<web::Bytes>) -> TestRequest {
+    request_for(path)
+        .insert_header(("content-type", "multipart/form-data; boundary=1234567890"))
+        .set_payload(body)
 }
 
-pub(crate) async fn make_app_data_from_config(config: AppConfig) -> Data<AppState> {
-    let state = AppState::init(&config).await.unwrap();
-    Data::new(state)
+pub(crate) async fn make_app_data_from_config(
+    config: AppConfig,
+) -> actix_web::Result<Data<AppState>> {
+    init_log();
+    AppState::init(&config)
+        .await
+        .map(Data::new)
+        .map_err(actix_web::error::ErrorInternalServerError)
 }
 
-pub(crate) async fn make_app_data() -> Data<AppState> {
-    init_log();
-    let config = test_config();
-    make_app_data_from_config(config).await
+/// Sends a GET request with the default test configuration, failing the test on error.
+pub(crate) async fn response_for(path: impl AsRef<str>) -> ServiceResponse {
+    response_with(path.as_ref(), test_config())
+        .await
+        .unwrap_or_else(|err| panic!("Request to {} failed: {err:#}", path.as_ref()))
 }
 
-pub(crate) async fn req_path(
+/// Sends a GET request with custom application configuration.
+pub(crate) async fn response_with(
     path: impl AsRef<str>,
-) -> Result<actix_web::dev::ServiceResponse, actix_web::Error> {
-    let req = get_request_to(path.as_ref()).await?.to_srv_request();
-    main_handler(req).await
+    config: AppConfig,
+) -> actix_web::Result<ServiceResponse> {
+    send_request(request_for(path), make_app_data_from_config(config).await?).await
 }
 
-const REQ_TIMEOUT: Duration = Duration::from_secs(8);
-pub(crate) async fn req_path_with_app_data(
-    path: impl AsRef<str>,
-    app_data: Data<AppState>,
-) -> anyhow::Result<actix_web::dev::ServiceResponse> {
-    req_path_with_app_data_and_accept(path, app_data, header::Accept::html()).await
+/// Sends a custom request with the default test configuration.
+pub(crate) async fn response_from(request: TestRequest) -> actix_web::Result<ServiceResponse> {
+    send_request(request, make_app_data_from_config(test_config()).await?).await
 }
 
-pub(crate) async fn req_path_with_app_data_json(
+/// Sends a GET request using existing state, for tests that share a database or cache.
+pub(crate) async fn response_with_data(
     path: impl AsRef<str>,
-    app_data: Data<AppState>,
-) -> anyhow::Result<actix_web::dev::ServiceResponse> {
-    req_path_with_app_data_and_accept(path, app_data, header::Accept::json()).await
+    data: Data<AppState>,
+) -> actix_web::Result<ServiceResponse> {
+    send_request(request_for(path), data).await
 }
 
-async fn req_path_with_app_data_and_accept(
-    path: impl AsRef<str>,
-    app_data: Data<AppState>,
-    accept: header::Accept,
-) -> anyhow::Result<actix_web::dev::ServiceResponse> {
-    let path = path.as_ref();
-    let req = TestRequest::get()
-        .uri(path)
-        .app_data(app_data)
-        .insert_header(("cookie", "test_cook=123"))
-        .insert_header(("authorization", "Basic dGVzdDp0ZXN0"))
-        .insert_header(accept)
-        .to_srv_request();
-    let resp = tokio::time::timeout(REQ_TIMEOUT, main_handler(req))
-        .await
-        .map_err(|e| anyhow::anyhow!("Request to {path} timed out: {e}"))?
-        .map_err(|e| {
-            anyhow::anyhow!(
-                "Request to {path} failed with status {}: {e:#}",
-                e.as_response_error().status_code()
-            )
-        })?;
-    Ok(resp)
+/// Runs a request through the production app, including its routes and middleware.
+/// Dropping the service disables and drains the pool, including on error or panic.
+/// Standalone `TestRequest::to_srv_request()` would instead leak the application state.
+pub(crate) async fn send_request(
+    request: TestRequest,
+    data: Data<AppState>,
+) -> actix_web::Result<ServiceResponse> {
+    let app = test::init_service(create_app(data)).await;
+    tokio::time::timeout(
+        Duration::from_secs(8),
+        test::try_call_service(&app, request.to_request()),
+    )
+    .await
+    .map_err(actix_web::error::ErrorGatewayTimeout)?
+    .map(ServiceResponse::map_into_boxed_body)
+}
+
+/// Reads a whole response body as a UTF-8 string, failing the test otherwise.
+pub(crate) async fn read_body_string<B>(resp: ServiceResponse<B>) -> String
+where
+    B: actix_web::body::MessageBody,
+{
+    String::from_utf8(test::read_body(resp).await.to_vec()).unwrap()
+}
+
+/// Whether the database engine is one of `kinds`.
+/// Tests that only run on some engines return early otherwise.
+pub(crate) fn supports_database(
+    db: &sqlpage::webserver::database::Database,
+    kinds: &[sqlpage::webserver::database::SupportedDatabase],
+) -> bool {
+    kinds.contains(&db.info.database_type)
+}
+
+pub(crate) async fn make_app_data() -> Data<AppState> {
+    make_app_data_from_config(test_config()).await.unwrap()
 }
 
 pub(crate) fn test_config() -> AppConfig {
-    let db_url = test_database_url();
-    serde_json::from_str::<AppConfig>(&format!(
-        r#"{{
-        "database_url": "{db_url}",
+    serde_json::from_value(serde_json::json!({
+        "database_url": test_database_url(),
         "max_database_pool_connections": 1,
         "database_connection_retries": 3,
         "database_connection_acquire_timeout_seconds": 15,
         "allow_exec": true,
-        "max_uploaded_file_size": 123456,
+        "max_uploaded_file_size": 123_456,
         "listen_on": "111.111.111.111:1",
-        "system_root_ca_certificates" : false
-    }}"#
-    ))
+        "system_root_ca_certificates": false
+    }))
     .unwrap()
 }
 
diff --git a/tests/cookies/mod.rs b/tests/cookies/mod.rs
index 1fa2b1db8..ed254d056 100644
--- a/tests/cookies/mod.rs
+++ b/tests/cookies/mod.rs
@@ -1,9 +1,9 @@
-use crate::common::req_path;
+use crate::common::response_for;
 use actix_web::http::StatusCode;
 use actix_web::http::header::SET_COOKIE;
 
 async fn set_cookie_header(path: &str) -> String {
-    let resp = req_path(path).await.unwrap();
+    let resp = response_for(path).await;
     resp.headers()
         .get(SET_COOKIE)
         .unwrap_or_else(|| panic!("{path} should have sent a Set-Cookie header"))
@@ -33,9 +33,7 @@ async fn zero_turns_off_a_cookie_protection() {
 
 #[actix_web::test]
 async fn a_page_made_only_of_header_components_still_sends_them() {
-    let resp = req_path("/tests/cookies/header_only_response.sql")
-        .await
-        .unwrap();
+    let resp = response_for("/tests/cookies/header_only_response.sql").await;
     assert_eq!(resp.status(), StatusCode::NO_CONTENT);
     assert!(resp.headers().contains_key(SET_COOKIE));
 }
diff --git a/tests/core/mod.rs b/tests/core/mod.rs
index 6062d877c..592360646 100644
--- a/tests/core/mod.rs
+++ b/tests/core/mod.rs
@@ -1,24 +1,61 @@
-use actix_web::{http::StatusCode, test};
+use actix_web::http::StatusCode;
 use sqlpage::{
     AppState,
     webserver::{self, make_placeholder},
 };
-use sqlx::executor::Executor as _;
 
-use crate::common::{make_app_data_from_config, req_path, req_path_with_app_data, test_config};
+use crate::common::{
+    make_app_data_from_config, response_for, response_with, response_with_data, test_config,
+};
 
 mod path_aliases;
 
+/// Creates the `sqlpage_files` table if needed and stores `contents` at `path`.
+/// Other tests share this database, so the table is never dropped.
+async fn store_file_in_db(state: &AppState, path: &str, contents: &[u8]) {
+    use sqlx::executor::Executor as _;
+
+    let create_table_sql =
+        sqlpage::filesystem::DbFsQueries::get_create_table_sql(state.db.info.database_type);
+    if state
+        .db
+        .connection
+        .execute("SELECT 1 FROM sqlpage_files WHERE 1 = 0")
+        .await
+        .is_err()
+    {
+        state.db.connection.execute(create_table_sql).await.unwrap();
+    }
+    let delete_sql = format!("DELETE FROM sqlpage_files WHERE path = '{path}'");
+    state
+        .db
+        .connection
+        .execute(delete_sql.as_str())
+        .await
+        .unwrap();
+    let insert_sql = format!(
+        "INSERT INTO sqlpage_files(path, contents) VALUES ({}, {})",
+        make_placeholder(state.db.info.kind, 1),
+        make_placeholder(state.db.info.kind, 2)
+    );
+    sqlx::query::query(&insert_sql)
+        .bind(path)
+        .bind(contents)
+        .execute(&state.db.connection)
+        .await
+        .unwrap();
+}
+
 #[actix_web::test]
 async fn test_concurrent_requests() {
     let components = [
         "table", "form", "card", "datagrid", "hero", "list", "timeline",
     ];
-    let app_data = make_app_data_from_config(test_config()).await;
+    let app_data = crate::common::make_app_data().await;
     let reqs = (0..64)
         .map(|i| {
             let component = components[i % components.len()];
-            req_path_with_app_data(
+            response_with_data(
                 format!("/tests/components/any_component.sql?component={component}"),
                 app_data.clone(),
             )
@@ -28,12 +65,8 @@ async fn test_concurrent_requests() {
     for result in results {
         let resp = result.unwrap();
         assert_eq!(resp.status(), StatusCode::OK);
-        let body = test::read_body(resp).await;
-        assert!(
-            body.starts_with(b"<!DOCTYPE html>"),
-            "Expected html doctype"
-        );
-        let body = String::from_utf8(body.to_vec()).unwrap();
+        let body = crate::common::read_body_string(resp).await;
+        assert!(body.starts_with("<!DOCTYPE html>"), "Expected html doctype");
         assert!(
             body.contains("It works !"),
             "Expected to contain: It works !, but got: {body}"
@@ -44,11 +77,9 @@ async fn test_concurrent_requests() {
 
 #[actix_web::test]
 async fn test_datagrid_description_presence_controls_placeholder() {
-    let resp = req_path("/tests/components/datagrid_icon_only.sql")
-        .await
-        .unwrap();
+    let resp = response_for("/tests/components/datagrid_icon_only.sql").await;
     assert_eq!(resp.status(), StatusCode::OK);
-    let body = String::from_utf8(test::read_body(resp).await.to_vec()).unwrap();
+    let body = crate::common::read_body_string(resp).await;
     assert!(body.contains("Facebook"), "{body}");
     assert!(body.contains("Empty"), "{body}");
     assert!(body.contains("Missing"), "{body}");
@@ -66,50 +97,23 @@ async fn test_routing_with_db_fs() {
     config.site_prefix = "/prefix/".to_string();
     let state = AppState::init(&config).await.unwrap();
 
-    if matches!(
-        state.db.info.database_type,
-        webserver::database::SupportedDatabase::Oracle
+    if crate::common::supports_database(
+        &state.db,
+        &[webserver::database::SupportedDatabase::Oracle],
     ) {
         return;
     }
 
-    let create_table_sql =
-        sqlpage::filesystem::DbFsQueries::get_create_table_sql(state.db.info.database_type);
-    // Other tests share this database, so never drop a table their initialized state may use.
-    if state
-        .db
-        .connection
-        .execute("SELECT 1 FROM sqlpage_files WHERE 1 = 0")
-        .await
-        .is_err()
-    {
-        state.db.connection.execute(create_table_sql).await.unwrap();
-    }
-    state
-        .db
-        .connection
-        .execute("DELETE FROM sqlpage_files WHERE path = 'on_db.sql'")
-        .await
-        .unwrap();
-    let insert_sql = format!(
-        "INSERT INTO sqlpage_files(path, contents) VALUES ('on_db.sql', {})",
-        make_placeholder(state.db.info.kind, 1)
-    );
-    sqlx::query::query(&insert_sql)
-        .bind("select ''text'' as component, ''Hi from db !'' AS contents;".as_bytes())
-        .execute(&state.db.connection)
-        .await
-        .unwrap();
-
-    let state = AppState::init(&config).await.unwrap();
-    let app_data = actix_web::web::Data::new(state);
+    store_file_in_db(
+        &state,
+        "on_db.sql",
+        b"select ''text'' as component, ''Hi from db !'' AS contents;",
+    )
+    .await;
 
-    let resp = req_path_with_app_data("/prefix/on_db.sql", app_data.clone())
-        .await
-        .unwrap();
+    let resp = response_with("/prefix/on_db.sql", config).await.unwrap();
     assert_eq!(resp.status(), StatusCode::OK);
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert!(
         body_str.contains("Hi from db !"),
         "{body_str}\nexpected to contain: Hi from db !"
@@ -128,35 +132,9 @@ async fn test_non_unicode_static_path_returns_bad_request_with_db_fs() {
 
     let state = AppState::init(&config).await.unwrap();
     let expected_db_path = "\u{FFFD}.txt";
-    let mut conn = state.db.connection.acquire().await.unwrap();
+    store_file_in_db(&state, expected_db_path, b"file from db fs").await;
 
-    (&mut *conn)
-        .execute(sqlpage::filesystem::DbFsQueries::get_create_table_sql(
-            webserver::database::SupportedDatabase::Sqlite,
-        ))
-        .await
-        .unwrap();
-    let insert_sql = format!(
-        "INSERT INTO sqlpage_files(path, contents) VALUES ({}, {})",
-        make_placeholder(state.db.info.kind, 1),
-        make_placeholder(state.db.info.kind, 2)
-    );
-    sqlx::query::query(&insert_sql)
-        .bind(expected_db_path)
-        .bind("file from db fs".as_bytes())
-        .execute(&mut *conn)
-        .await
-        .unwrap();
-    drop(conn);
-
-    let state = AppState::init(&config).await.unwrap();
-    let app_data = actix_web::web::Data::new(state);
-    let req = test::TestRequest::get()
-        .uri("/%FF.txt")
-        .app_data(app_data)
-        .to_srv_request();
-
-    let err = webserver::http::main_handler(req)
+    let err = response_with("/%FF.txt", config)
         .await
         .expect_err("non-unicode path should not panic and must return bad request");
     assert_eq!(
@@ -169,18 +147,13 @@ async fn test_non_unicode_static_path_returns_bad_request_with_db_fs() {
 async fn test_routing_with_prefix() {
     let mut config = test_config();
     config.site_prefix = "/prefix/".to_string();
-    let state = AppState::init(&config).await.unwrap();
-
-    let app_data = actix_web::web::Data::new(state);
-    let resp = req_path_with_app_data(
-        "/prefix/tests/sql_test_files/component_rendering/simple.sql",
-        app_data.clone(),
-    )
-    .await
-    .unwrap();
+    let app_data = make_app_data_from_config(config).await.unwrap();
+    let path = "/tests/sql_test_files/component_rendering/simple.sql";
+    let resp = response_with_data(format!("/prefix{path}"), app_data.clone())
+        .await
+        .unwrap();
     assert_eq!(resp.status(), StatusCode::OK);
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert!(
         body_str.contains("It works !"),
         "{body_str}\nexpected to contain: It works !"
@@ -190,47 +163,41 @@ async fn test_routing_with_prefix() {
         "{body_str}\nexpected to contain links with site prefix"
     );
 
-    let resp = req_path_with_app_data("/prefix/nonexistent.sql", app_data.clone())
+    let resp = response_with_data("/prefix/nonexistent.sql", app_data.clone())
         .await
         .expect("should handle 404");
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert!(
         body_str.contains("404"),
         "Response should contain \"404\", but got:\n{body_str}"
     );
 
-    let resp = req_path_with_app_data("/prefix/sqlpage/migrations/0001_init.sql", app_data.clone())
+    let resp = response_with_data("/prefix/sqlpage/migrations/0001_init.sql", app_data.clone())
         .await
         .expect_err("Expected forbidden error")
-        .to_string();
-    assert!(resp.to_lowercase().contains("forbidden"), "{resp}");
+        .as_response_error()
+        .status_code();
+    assert_eq!(resp, StatusCode::FORBIDDEN);
 
-    let resp = req_path_with_app_data(
-        "/tests/sql_test_files/component_rendering/simple.sql",
-        app_data,
-    )
-    .await
-    .unwrap();
-    assert_eq!(resp.status(), StatusCode::MOVED_PERMANENTLY);
+    let resp = response_with_data(path, app_data).await.unwrap();
+    assert_eq!(resp.status(), StatusCode::PERMANENT_REDIRECT);
     let location = resp
         .headers()
         .get("location")
         .expect("location header should be present");
-    assert_eq!(location.to_str().unwrap(), "/prefix/");
+    assert_eq!(location.to_str().unwrap(), format!("/prefix{path}"));
 }
 
 #[actix_web::test]
 async fn test_hidden_files() {
-    let resp_result = req_path("/tests/core/.hidden.sql").await;
+    let resp_result = response_with("/tests/core/.hidden.sql", test_config()).await;
     assert!(
         resp_result.is_err(),
         "Accessing a hidden file should be forbidden, but received success: {resp_result:?}"
     );
     let resp = resp_result.unwrap_err().error_response();
     assert_eq!(resp.status(), StatusCode::FORBIDDEN);
-    let srv_resp = test::TestRequest::default().to_srv_response(resp);
-    let body = test::read_body(srv_resp).await;
+    let body = actix_web::body::to_bytes(resp.into_body()).await.unwrap();
     assert!(
         String::from_utf8_lossy(&body)
             .to_lowercase()
@@ -241,14 +208,13 @@ async fn test_hidden_files() {
 #[actix_web::test]
 async fn test_official_website_documentation() {
     let app_data = make_app_data_for_official_website().await;
-    let resp = req_path_with_app_data("/component.sql?component=button", app_data)
+    let resp = response_with_data("/component.sql?component=button", app_data)
         .await
         .unwrap_or_else(|e| {
             panic!("Failed to get response for /component.sql?component=button: {e}")
         });
     assert_eq!(resp.status(), StatusCode::OK);
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert!(
         body_str.contains(r#"<button type="submit" form="poem" formaction="?action"#),
         "{body_str}\nexpected to contain a button with formaction"
@@ -257,15 +223,14 @@ async fn test_official_website_documentation() {
 
 #[actix_web::test]
 async fn test_official_website_basic_auth_example() {
-    let resp = req_path_with_app_data(
+    let resp = response_with_data(
         "/examples/authentication/basic_auth.sql",
         make_app_data_for_official_website().await,
     )
     .await
     .unwrap();
     assert_eq!(resp.status(), StatusCode::UNAUTHORIZED);
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert!(
         body_str.contains("Unauthorized"),
         "{body_str}\nexpected to contain Unauthorized"
@@ -278,7 +243,7 @@ async fn make_app_data_for_official_website() -> actix_web::web::Data<AppState>
     let mut app_config = sqlpage::app_config::load_from_directory(config_path).unwrap();
     app_config.web_root = std::path::PathBuf::from("examples/official-site");
     app_config.database_url = "sqlite::memory:".to_string();
-    let app_state = make_app_data_from_config(app_config.clone()).await;
+    let app_state = make_app_data_from_config(app_config.clone()).await.unwrap();
     webserver::database::migrations::apply(&app_config, &app_state.db)
         .await
         .unwrap();
diff --git a/tests/core/path_aliases.rs b/tests/core/path_aliases.rs
index a83b3f68a..b1b1516bc 100644
--- a/tests/core/path_aliases.rs
+++ b/tests/core/path_aliases.rs
@@ -1,11 +1,9 @@
 use actix_web::{body::to_bytes, http::StatusCode};
-use sqlpage::webserver::http::main_handler;
 
-use crate::common::get_request_to;
+use crate::common::{response_with, test_config};
 
 async fn assert_sql_response(path: &str, expected_status: StatusCode) {
-    let request = get_request_to(path).await.unwrap().to_srv_request();
-    let response = match main_handler(request).await {
+    let response = match response_with(path, test_config()).await {
         Ok(response) => response.into_parts().1,
         Err(error) => error.error_response(),
     };
diff --git a/tests/data_formats/mod.rs b/tests/data_formats/mod.rs
index 7c6c3d2f1..49929c9c3 100644
--- a/tests/data_formats/mod.rs
+++ b/tests/data_formats/mod.rs
@@ -1,30 +1,22 @@
 use actix_web::{
     http::{StatusCode, header},
-    test::{self, TestRequest},
+    test,
 };
-use sqlpage::webserver::http::main_handler;
 
-use crate::common::{get_request_to, make_app_data};
+use crate::common::{
+    make_app_data, request_for, response_for, response_from, response_with_data, send_request,
+};
 
 async fn req_with_accept(
     path: &str,
     accept: &str,
 ) -> actix_web::Result<actix_web::dev::ServiceResponse> {
-    let app_data = make_app_data().await;
-    let req = TestRequest::get()
-        .uri(path)
-        .insert_header((header::ACCEPT, accept))
-        .app_data(app_data)
-        .to_srv_request();
-    main_handler(req).await
+    response_from(request_for(path).insert_header((header::ACCEPT, accept))).await
 }
 
 #[actix_web::test]
 async fn test_json_body() -> actix_web::Result<()> {
-    let req = get_request_to("/tests/data_formats/json_data.sql")
-        .await?
-        .to_srv_request();
-    let resp = main_handler(req).await?;
+    let resp = response_for("/tests/data_formats/json_data.sql").await;
 
     assert_eq!(resp.status(), StatusCode::OK);
     assert_eq!(
@@ -42,25 +34,21 @@ async fn test_json_body() -> actix_web::Result<()> {
 #[actix_web::test]
 async fn test_csv_body() -> actix_web::Result<()> {
     let app_data = make_app_data().await;
-    if matches!(
-        app_data.db.info.database_type,
-        sqlpage::webserver::database::SupportedDatabase::Oracle
+    if crate::common::supports_database(
+        &app_data.db,
+        &[sqlpage::webserver::database::SupportedDatabase::Oracle],
     ) {
         return Ok(());
     }
 
-    let req = crate::common::get_request_to_with_data("/tests/data_formats/csv_data.sql", app_data)
-        .await?
-        .to_srv_request();
-    let resp = main_handler(req).await?;
+    let resp = response_with_data("/tests/data_formats/csv_data.sql", app_data).await?;
 
     assert_eq!(resp.status(), StatusCode::OK);
     assert_eq!(
         resp.headers().get(header::CONTENT_TYPE).unwrap(),
         "text/csv; charset=utf-8"
     );
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert_eq!(
         body_str,
         "id;msg\n0;Hello World !\n1;\"Tu gères ';' et '\"\"' ?\"\n"
@@ -77,9 +65,7 @@ async fn test_csv_filename_header_injection() -> actix_web::Result<()> {
     // Content-Disposition header. The attacker-supplied value must NOT create a
     // second, agent-preferred parameter; it has to stay inside a single,
     // properly quoted `filename` value.
-    let resp = crate::common::req_path("/tests/data_formats/csv_filename_injection.sql")
-        .await
-        .expect("request failed");
+    let resp = response_for("/tests/data_formats/csv_filename_injection.sql").await;
     assert_eq!(resp.status(), StatusCode::OK);
     let raw = resp
         .headers()
@@ -110,19 +96,22 @@ async fn test_csv_filename_header_injection() -> actix_web::Result<()> {
 #[actix_web::test]
 async fn test_json_columns() {
     let app_data = make_app_data().await;
-    if !matches!(
-        app_data.db.to_string().to_lowercase().as_str(),
-        "postgres" | "sqlite"
+    if !crate::common::supports_database(
+        &app_data.db,
+        &[
+            sqlpage::webserver::database::SupportedDatabase::Postgres,
+            sqlpage::webserver::database::SupportedDatabase::Sqlite,
+        ],
     ) {
         log::info!("Skipping test_json_columns on database {}", app_data.db);
         return;
     }
 
-    let resp_result = crate::common::req_path("/tests/data_formats/json_columns.sql").await;
-    let resp = resp_result.expect("Failed to request /tests/data_formats/json_columns.sql");
+    let resp = response_with_data("/tests/data_formats/json_columns.sql", app_data)
+        .await
+        .expect("Failed to request /tests/data_formats/json_columns.sql");
     assert_eq!(resp.status(), StatusCode::OK);
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     let body_html_escaped = body_str.replace("&quot;", "\"");
     assert!(
         !body_html_escaped.contains("error"),
@@ -173,8 +162,7 @@ async fn test_accept_ndjson_returns_jsonlines() -> actix_web::Result<()> {
         resp.headers().get(header::CONTENT_TYPE).unwrap(),
         "application/x-ndjson"
     );
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     let lines: Vec<&str> = body_str.trim().lines().collect();
     assert!(lines.len() >= 2);
     assert_eq!(
@@ -234,24 +222,30 @@ async fn test_accept_json_redirect_still_works() -> actix_web::Result<()> {
 
 /// Builds an `AppState` running in production mode.
 async fn make_prod_app_data() -> actix_web::web::Data<sqlpage::AppState> {
-    crate::common::init_log();
-    let mut config = crate::common::test_config();
-    config.environment = sqlpage::app_config::DevOrProd::Production;
-    crate::common::make_app_data_from_config(config).await
+    crate::common::make_app_data_from_config(sqlpage::app_config::AppConfig {
+        environment: sqlpage::app_config::DevOrProd::Production,
+        ..crate::common::test_config()
+    })
+    .await
+    .unwrap()
 }
 
-async fn req_prod_with_accept(path: &str, accept: &str) -> String {
-    let app_data = make_prod_app_data().await;
-    let req = TestRequest::get()
-        .uri(path)
-        .insert_header((header::ACCEPT, accept))
-        .app_data(app_data)
-        .to_srv_request();
-    let resp = main_handler(req)
-        .await
-        .expect("request should not fail at the handler level");
-    let body = test::read_body(resp).await;
-    String::from_utf8(body.to_vec()).unwrap()
+async fn response_body_with_accept(
+    path: &str,
+    accept: &str,
+    app_data: actix_web::web::Data<sqlpage::AppState>,
+) -> String {
+    let resp = send_request(
+        request_for(path).insert_header((header::ACCEPT, accept)),
+        app_data,
+    )
+    .await
+    .expect("request should not fail at the handler level");
+    crate::common::read_body_string(resp).await
+}
+
+async fn req_prod_body(path: &str, accept: &str) -> String {
+    response_body_with_accept(path, accept, make_prod_app_data().await).await
 }
 
 /// In production, a SQL error that happens mid-stream must not leak the SQL
@@ -276,7 +270,7 @@ fn assert_no_sql_leak(body: &str, context: &str) {
 
 #[actix_web::test]
 async fn test_prod_json_error_does_not_leak_sql() {
-    let body = req_prod_with_accept(
+    let body = req_prod_body(
         "/tests/data_formats/json_error_leak.sql",
         "application/json",
     )
@@ -291,20 +285,18 @@ async fn test_prod_json_error_does_not_leak_sql() {
 #[actix_web::test]
 async fn test_prod_csv_error_does_not_leak_sql() {
     let app_data = make_prod_app_data().await;
-    if matches!(
-        app_data.db.info.database_type,
-        sqlpage::webserver::database::SupportedDatabase::Oracle
+    if crate::common::supports_database(
+        &app_data.db,
+        &[sqlpage::webserver::database::SupportedDatabase::Oracle],
     ) {
         return;
     }
-    let req = TestRequest::get()
-        .uri("/tests/data_formats/csv_error_leak.sql")
-        .insert_header((header::ACCEPT, "text/csv"))
-        .app_data(app_data)
-        .to_srv_request();
-    let resp = main_handler(req).await.expect("handler should not fail");
-    let body = test::read_body(resp).await;
-    let body = String::from_utf8(body.to_vec()).unwrap();
+    let body = response_body_with_accept(
+        "/tests/data_formats/csv_error_leak.sql",
+        "text/csv",
+        app_data,
+    )
+    .await;
     assert!(
         body.contains("before the error"),
         "the good row should still be streamed: {body}"
@@ -318,20 +310,18 @@ async fn test_prod_csv_error_does_not_leak_sql() {
 #[actix_web::test]
 async fn test_prod_csv_error_before_any_row_still_reports() {
     let app_data = make_prod_app_data().await;
-    if matches!(
-        app_data.db.info.database_type,
-        sqlpage::webserver::database::SupportedDatabase::Oracle
+    if crate::common::supports_database(
+        &app_data.db,
+        &[sqlpage::webserver::database::SupportedDatabase::Oracle],
     ) {
         return;
     }
-    let req = TestRequest::get()
-        .uri("/tests/data_formats/csv_error_no_rows.sql")
-        .insert_header((header::ACCEPT, "text/csv"))
-        .app_data(app_data)
-        .to_srv_request();
-    let resp = main_handler(req).await.expect("handler should not fail");
-    let body = test::read_body(resp).await;
-    let body = String::from_utf8(body.to_vec()).unwrap();
+    let body = response_body_with_accept(
+        "/tests/data_formats/csv_error_no_rows.sql",
+        "text/csv",
+        app_data,
+    )
+    .await;
     assert!(
         body.to_lowercase().contains("administrator"),
         "csv error before the first row must still emit the generic error message: {body:?}"
@@ -344,7 +334,7 @@ async fn test_prod_csv_error_before_any_row_still_reports() {
 /// In production that path must not leak SQL text either.
 #[actix_web::test]
 async fn test_prod_html_page_requested_as_json_does_not_leak_sql() {
-    let body = req_prod_with_accept(
+    let body = req_prod_body(
         "/tests/data_formats/text_error_leak.sql",
         "application/json",
     )
diff --git a/tests/errors/basic_auth.rs b/tests/errors/basic_auth.rs
index 69330691a..e6de1b613 100644
--- a/tests/errors/basic_auth.rs
+++ b/tests/errors/basic_auth.rs
@@ -1,18 +1,15 @@
-use crate::common::{get_request_to, req_path};
-use actix_web::{http::StatusCode, test};
-use sqlpage::webserver::http::main_handler;
+use crate::common::{request_for, response_for, response_from};
+use actix_web::http::StatusCode;
 
 #[actix_web::test]
 async fn test_basic_auth_not_provided() {
-    let resp_result = req_path("/tests/errors/basic_auth.sql").await;
-    let resp = resp_result.unwrap();
+    let resp = response_for("/tests/errors/basic_auth.sql").await;
     assert_eq!(resp.status(), StatusCode::UNAUTHORIZED);
     assert_eq!(
         resp.headers().get("www-authenticate").unwrap(),
         "Basic realm=\"Authentication required\", charset=\"UTF-8\""
     );
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert!(
         body_str.contains("Unauthorized"),
         "{body_str}\nexpected to contain Unauthorized"
@@ -25,17 +22,13 @@ async fn test_basic_auth_not_provided() {
 
 #[actix_web::test]
 async fn test_basic_auth_with_credentials() {
-    let req = get_request_to("/tests/errors/basic_auth.sql")
-        .await
-        .unwrap() // log in with credentials "user:password"
-        .append_header(("Authorization", "Basic dXNlcjpwYXNzd29yZA=="))
-        .to_srv_request();
-    let resp = main_handler(req)
+    let req = request_for("/tests/errors/basic_auth.sql") // log in with credentials "user:password"
+        .append_header(("Authorization", "Basic dXNlcjpwYXNzd29yZA=="));
+    let resp = response_from(req)
         .await
         .expect("req with credentials should succeed");
     assert_eq!(resp.status(), StatusCode::OK);
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert!(
         body_str.contains("Success!"),
         "{body_str}\nexpected to contain Success"
diff --git a/tests/errors/invalid_header.rs b/tests/errors/invalid_header.rs
index 73bf8dc46..fd8b7e7ef 100644
--- a/tests/errors/invalid_header.rs
+++ b/tests/errors/invalid_header.rs
@@ -1,5 +1,5 @@
-use crate::common::req_path;
-use actix_web::{http::StatusCode, test};
+use crate::common::response_for;
+use actix_web::http::StatusCode;
 use percent_encoding::{NON_ALPHANUMERIC, utf8_percent_encode};
 use serde_json::{Value, json};
 
@@ -13,12 +13,7 @@ async fn assert_invalid_header_response(case: &InvalidHeaderCase) {
     let properties = utf8_percent_encode(&properties, NON_ALPHANUMERIC).to_string();
     let path = format!("/tests/errors/invalid_header.sql?properties={properties}");
 
-    let resp = req_path(&path).await.unwrap_or_else(|err| {
-        panic!(
-            "{} should return an error response instead of failing the request: {err:#}",
-            case.name
-        )
-    });
+    let resp = response_for(&path).await;
 
     assert_eq!(
         resp.status(),
@@ -27,8 +22,7 @@ async fn assert_invalid_header_response(case: &InvalidHeaderCase) {
         case.name
     );
 
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert!(
         body_str.to_lowercase().contains("error"),
         "{} should render an error response body, got:\n{body_str}",
diff --git a/tests/errors/mod.rs b/tests/errors/mod.rs
index a6bfe55a6..4005c99c9 100644
--- a/tests/errors/mod.rs
+++ b/tests/errors/mod.rs
@@ -1,27 +1,9 @@
-use actix_web::{
-    http::{self, StatusCode},
-    test,
-};
-use sqlpage::{AppState, webserver::http::main_handler};
+use actix_web::http::StatusCode;
 
-use crate::common::{make_app_data_from_config, req_path, req_path_with_app_data, test_config};
+use crate::common::{make_app_data_from_config, response_with, response_with_data, test_config};
 mod basic_auth;
 mod invalid_header;
 
-/// Sends a direct unprivileged GET request through the main handler and returns the
-/// resulting HTTP status, whether the handler returned an `Ok` response or an `Err`.
-async fn direct_request_status(path: &str, app_data: actix_web::web::Data<AppState>) -> StatusCode {
-    let req = test::TestRequest::get()
-        .uri(path)
-        .app_data(app_data)
-        .insert_header(http::header::Accept::html())
-        .to_srv_request();
-    match main_handler(req).await {
-        Ok(resp) => resp.status(),
-        Err(e) => e.error_response().status(),
-    }
-}
-
 /// Regression test for a cache privilege-escalation bug.
 ///
 /// `sqlpage.run_sql(...)` loads include files with privilege, so it is allowed to
@@ -35,14 +17,14 @@ async fn test_private_path_not_accessible_after_privileged_cache_priming() {
     // Keep cache entries "fresh" so the bug (skipping the path guard on fresh hits) is exercised.
     let mut config = test_config();
     config.cache_stale_duration_ms = Some(60_000);
-    let app_data = make_app_data_from_config(config).await;
+    let app_data = make_app_data_from_config(config).await.unwrap();
 
     // 1. A trusted page primes the cache by loading the reserved file with privilege.
-    let prime = req_path_with_app_data("/tests/errors/prime_private_cache.sql", app_data.clone())
+    let prime = response_with_data("/tests/errors/prime_private_cache.sql", app_data.clone())
         .await
         .expect("priming page should render");
     assert_eq!(prime.status(), StatusCode::OK);
-    let prime_body = String::from_utf8(test::read_body(prime).await.to_vec()).unwrap();
+    let prime_body = crate::common::read_body_string(prime).await;
     assert!(
         prime_body.contains("private cache bypass secret"),
         "priming page should have executed the private file via run_sql, got: {prime_body}"
@@ -54,7 +36,11 @@ async fn test_private_path_not_accessible_after_privileged_cache_priming() {
         // Extensionless alias: routing appends .sql and finds the fresh cache entry.
         "/sqlpage/private_cache_bypass_test",
     ] {
-        let status = direct_request_status(path, app_data.clone()).await;
+        let status = response_with_data(path, app_data.clone())
+            .await
+            .unwrap_err()
+            .as_response_error()
+            .status_code();
         assert_eq!(
             status,
             StatusCode::FORBIDDEN,
@@ -65,15 +51,14 @@ async fn test_private_path_not_accessible_after_privileged_cache_priming() {
 
 #[actix_web::test]
 async fn test_privileged_paths_are_not_accessible() {
-    let resp_result = req_path("/sqlpage/migrations/0001_init.sql").await;
+    let resp_result = response_with("/sqlpage/migrations/0001_init.sql", test_config()).await;
     assert!(
         resp_result.is_err(),
         "Accessing a migration file should be forbidden, but received success: {resp_result:?}"
     );
     let resp = resp_result.unwrap_err().error_response();
     assert_eq!(resp.status(), StatusCode::FORBIDDEN);
-    let srv_resp = test::TestRequest::default().to_srv_response(resp);
-    let body = test::read_body(srv_resp).await;
+    let body = actix_web::body::to_bytes(resp.into_body()).await.unwrap();
     assert!(
         String::from_utf8_lossy(&body)
             .to_lowercase()
@@ -83,100 +68,50 @@ async fn test_privileged_paths_are_not_accessible() {
 
 #[actix_web::test]
 async fn test_404_fallback() {
+    let app_data = crate::common::make_app_data().await;
     for f in [
         "/tests/errors/does_not_exist.sql",
         "/tests/errors/does_not_exist.html",
         "/tests/errors/does_not_exist/",
     ] {
-        let resp_result = req_path(f).await;
-        let resp = resp_result.unwrap();
+        let resp = response_with_data(f, app_data.clone()).await.unwrap();
         assert_eq!(resp.status(), StatusCode::OK, "{f} isnt 200");
-
-        let body = test::read_body(resp).await;
-        assert!(body.starts_with(b"<!DOCTYPE html>"));
-        let body = String::from_utf8(body.to_vec()).unwrap();
-        assert!(body.contains("But the "));
-        assert!(body.contains("404.sql"));
-        assert!(body.contains("file saved the day!"));
-        assert!(!body.contains("error"));
+        let body = crate::common::read_body_string(resp).await;
+        assert!(body.starts_with("<!DOCTYPE html>"));
+        for marker in ["But the ", "404.sql", "file saved the day!"] {
+            assert!(body.contains(marker), "{f} should contain {marker:?}");
+        }
+        assert!(!body.contains("error"), "{f} should not contain an error");
     }
 }
 
 #[actix_web::test]
 async fn test_default_404() {
+    let app_data = crate::common::make_app_data().await;
+    let msg = "The page you were looking for does not exist";
     for f in [
         "/i-do-not-exist.html",
         "/i-do-not-exist.sql",
         "/i-do-not-exist/",
+        "/i-do-not-exist",
+        "/tests/it_works.txt/site/wp-includes/wlwmanifest.xml",
     ] {
-        let resp_result = req_path(f).await;
-        let resp = resp_result.unwrap();
+        let resp = response_with_data(f, app_data.clone()).await.unwrap();
         assert_eq!(
             resp.status(),
             StatusCode::NOT_FOUND,
             "{f} should return 404"
         );
-
-        let body = test::read_body(resp).await;
-        assert!(body.starts_with(b"<!DOCTYPE html>"));
-        let body = String::from_utf8(body.to_vec()).unwrap();
-        let msg = "The page you were looking for does not exist";
-        assert!(
-            body.contains(msg),
-            "{f} should contain '{msg}' but got:\n{body}"
-        );
-        assert!(!body.contains("error"));
+        let body = crate::common::read_body_string(resp).await;
+        assert!(body.starts_with("<!DOCTYPE html>"), "{f} is not HTML");
+        assert!(body.contains(msg), "{f} should contain {msg:?}");
+        assert!(!body.contains("error"), "{f} should not contain an error");
     }
 }
 
-#[actix_web::test]
-async fn test_default_404_with_redirect() {
-    let resp_result = req_path("/i-do-not-exist").await;
-    let resp = resp_result.unwrap();
-    assert_eq!(
-        resp.status(),
-        StatusCode::NOT_FOUND,
-        "/i-do-not-exist should return 404"
-    );
-
-    let resp_result = req_path("/i-do-not-exist/").await;
-    let resp = resp_result.unwrap();
-    assert_eq!(
-        resp.status(),
-        StatusCode::NOT_FOUND,
-        "/i-do-not-exist/ should return 404"
-    );
-
-    let body = test::read_body(resp).await;
-    assert!(body.starts_with(b"<!DOCTYPE html>"));
-    let body = String::from_utf8(body.to_vec()).unwrap();
-    let msg = "The page you were looking for does not exist";
-    assert!(
-        body.contains(msg),
-        "/i-do-not-exist/ should contain '{msg}' but got:\n{body}"
-    );
-    assert!(!body.contains("error"));
-}
-
-#[actix_web::test]
-async fn test_default_404_when_request_path_descends_into_file() {
-    let resp_result = req_path("/tests/it_works.txt/site/wp-includes/wlwmanifest.xml").await;
-    let resp = resp_result.unwrap();
-    assert_eq!(
-        resp.status(),
-        StatusCode::NOT_FOUND,
-        "descending into a file path should behave like a missing resource"
-    );
-
-    let body = test::read_body(resp).await;
-    let body = String::from_utf8(body.to_vec()).unwrap();
-    assert!(body.contains("The page you were looking for does not exist"));
-    assert!(!body.contains("error"));
-}
-
 #[actix_web::test]
 async fn test_requesting_a_directory_is_not_found() {
-    let resp_result = req_path("/tests/errors/is_a_directory.d").await;
+    let resp_result = response_with("/tests/errors/is_a_directory.d", test_config()).await;
     let status = match resp_result {
         Ok(resp) => resp.status(),
         Err(e) => e.as_response_error().status_code(),
diff --git a/tests/exec/mod.rs b/tests/exec/mod.rs
index 6eb8fa865..e7b4a9ca7 100644
--- a/tests/exec/mod.rs
+++ b/tests/exec/mod.rs
@@ -1,16 +1,12 @@
-use actix_web::{http::header, test::TestRequest};
-use sqlpage::webserver::http::main_handler;
+use actix_web::http::header;
 
 #[actix_web::test]
 async fn test_exec() {
-    let app_data = crate::common::make_app_data().await;
-    let req = TestRequest::get()
-        .uri(exec_test_uri())
-        .app_data(app_data)
-        .insert_header(header::Accept::json())
-        .to_srv_request();
-
-    let resp = main_handler(req).await.unwrap();
+    let resp = crate::common::response_from(
+        crate::common::request_for(exec_test_uri()).insert_header(header::Accept::json()),
+    )
+    .await
+    .unwrap();
     let body = actix_web::test::read_body(resp).await;
     let rows: Vec<serde_json::Value> = serde_json::from_slice(&body).unwrap();
     let actual = rows[0]["actual"].as_str().unwrap();
diff --git a/tests/oidc/mod.rs b/tests/oidc/mod.rs
index 4eba0421c..41cd935cf 100644
--- a/tests/oidc/mod.rs
+++ b/tests/oidc/mod.rs
@@ -6,8 +6,7 @@ use actix_web::{
     web::{self, Data},
 };
 use base64::Engine;
-use openidconnect::url::Url;
-use serde::{Deserialize, Serialize};
+use openidconnect::{IssuerUrl, url::Url};
 use serde_json::json;
 use sqlpage::webserver::http::create_app;
 use std::collections::HashMap;
@@ -55,47 +54,21 @@ struct ProviderState<'a> {
     discovery_count: usize,
 }
 
-type ProviderStateWithLifetime<'a> = ProviderState<'a>;
-type SharedProviderState = Arc<Mutex<ProviderStateWithLifetime<'static>>>;
-
-#[derive(Serialize, Deserialize)]
-struct DiscoveryResponse {
-    issuer: String,
-    authorization_endpoint: String,
-    token_endpoint: String,
-    jwks_uri: String,
-    response_types_supported: Vec<String>,
-    subject_types_supported: Vec<String>,
-    id_token_signing_alg_values_supported: Vec<String>,
-    end_session_endpoint: String,
-}
-
-#[derive(Serialize)]
-struct JwksResponse {
-    keys: Vec<serde_json::Value>,
-}
-
-#[derive(Serialize)]
-struct TokenResponse {
-    access_token: String,
-    token_type: String,
-    id_token: String,
-    expires_in: i64,
-}
+type SharedProviderState = Arc<Mutex<ProviderState<'static>>>;
 
 async fn discovery_endpoint(state: Data<SharedProviderState>) -> impl Responder {
     let mut state = state.lock().unwrap();
     state.discovery_count += 1;
-    let discovery = DiscoveryResponse {
-        issuer: state.issuer_url.clone(),
-        authorization_endpoint: format!("{}/auth", state.issuer_url),
-        token_endpoint: format!("{}/token", state.issuer_url),
-        jwks_uri: format!("{}/jwks", state.issuer_url),
-        response_types_supported: vec!["code".to_string()],
-        subject_types_supported: vec!["public".to_string()],
-        id_token_signing_alg_values_supported: vec!["HS256".to_string()],
-        end_session_endpoint: format!("{}/logout", state.issuer_url),
-    };
+    let discovery = json!({
+        "issuer": state.issuer_url,
+        "authorization_endpoint": format!("{}/auth", state.issuer_url),
+        "token_endpoint": format!("{}/token", state.issuer_url),
+        "jwks_uri": format!("{}/jwks", state.issuer_url),
+        "response_types_supported": ["code"],
+        "subject_types_supported": ["public"],
+        "id_token_signing_alg_values_supported": ["HS256"],
+        "end_session_endpoint": format!("{}/logout", state.issuer_url),
+    });
     drop(state);
     HttpResponse::Ok()
         .insert_header((header::CONTENT_TYPE, "application/json"))
@@ -104,15 +77,15 @@ async fn discovery_endpoint(state: Data<SharedProviderState>) -> impl Responder
 
 async fn jwks_endpoint(state: Data<SharedProviderState>) -> impl Responder {
     let state = state.lock().unwrap();
-    let jwks = JwksResponse {
-        keys: vec![json!({
+    let jwks = json!({
+        "keys": [{
             "kty": "oct",
             "kid": "test",
             "use": "sig",
             "alg": "HS256",
             "k": base64url_encode(state.secret.as_bytes())
-        })],
-    };
+        }]
+    });
     HttpResponse::Ok()
         .insert_header((header::CONTENT_TYPE, "application/json"))
         .json(jwks)
@@ -149,12 +122,12 @@ async fn token_endpoint(
     let delay = state.token_endpoint_delay;
     drop(state);
 
-    let response = TokenResponse {
-        access_token: "test_access_token".to_string(),
-        token_type: "Bearer".to_string(),
-        id_token,
-        expires_in: 3600,
-    };
+    let response = json!({
+        "access_token": "test_access_token",
+        "token_type": "Bearer",
+        "id_token": id_token,
+        "expires_in": 3600,
+    });
 
     let json_bytes = serde_json::to_vec(&response).unwrap();
     let body = futures_util::stream::once(async move {
@@ -324,6 +297,97 @@ async fn setup_oidc_test(
     setup_oidc_test_with_paths(provider_mutator, &["/"], &[]).await
 }
 
+/// Builds an OIDC test config on top of [`crate::common::test_config`],
+/// so all tests share the base settings (pool size, timeouts, ...).
+fn oidc_test_config(
+    provider: &FakeOidcProvider,
+    protected_paths: &[&str],
+    public_paths: &[&str],
+) -> sqlpage::app_config::AppConfig {
+    let mut config = crate::common::test_config();
+    config.oidc_issuer_url = Some(IssuerUrl::new(provider.issuer_url.clone()).unwrap());
+    config.oidc_client_id.clone_from(&provider.client_id);
+    config.oidc_client_secret = Some(provider.client_secret.clone());
+    config.oidc_protected_paths = protected_paths.iter().map(ToString::to_string).collect();
+    config.oidc_public_paths = public_paths.iter().map(ToString::to_string).collect();
+    config
+}
+
+/// Result of driving a full OIDC login flow in a test.
+struct OidcLogin<B> {
+    /// The initial redirect to the identity provider.
+    initial_response: actix_web::dev::ServiceResponse<B>,
+    /// The response of following the authorization callback.
+    callback_response: actix_web::dev::ServiceResponse<B>,
+}
+
+/// Runs the first half of the login flow: GET the protected page and build
+/// the authorization callback URI for `code`, storing it at the provider.
+/// `state_override` tampers with the state sent back to the callback.
+async fn begin_login<S, B>(
+    app: &S,
+    provider: &FakeOidcProvider,
+    cookies: &mut Vec<Cookie<'static>>,
+    code: &str,
+    state_override: Option<&str>,
+) -> (actix_web::dev::ServiceResponse<B>, Url, String)
+where
+    S: actix_web::dev::Service<
+            actix_http::Request,
+            Response = actix_web::dev::ServiceResponse<B>,
+            Error = actix_web::Error,
+        >,
+    B: actix_web::body::MessageBody,
+{
+    let initial_response = request_with_cookies!(app, test::TestRequest::get().uri("/"), cookies);
+    assert_eq!(initial_response.status(), StatusCode::SEE_OTHER);
+    let auth_url = Url::parse(
+        initial_response
+            .headers()
+            .get("location")
+            .unwrap()
+            .to_str()
+            .unwrap(),
+    )
+    .unwrap();
+    let state = get_query_param(&auth_url, "state");
+    let nonce = get_query_param(&auth_url, "nonce");
+    let redirect_uri = get_query_param(&auth_url, "redirect_uri");
+    provider.store_auth_code(code.to_string(), nonce);
+    let callback_state = state_override.unwrap_or(&state).to_string();
+    let callback_uri = format!(
+        "{}?code={code}&state={callback_state}",
+        Url::parse(&redirect_uri).unwrap().path(),
+    );
+    (initial_response, auth_url, callback_uri)
+}
+
+/// Performs a full OIDC login with `code` and returns every step.
+async fn complete_login<S, B>(
+    app: &S,
+    provider: &FakeOidcProvider,
+    cookies: &mut Vec<Cookie<'static>>,
+    code: &str,
+    state_override: Option<&str>,
+) -> OidcLogin<B>
+where
+    S: actix_web::dev::Service<
+            actix_http::Request,
+            Response = actix_web::dev::ServiceResponse<B>,
+            Error = actix_web::Error,
+        >,
+    B: actix_web::body::MessageBody,
+{
+    let (initial_response, _, callback_uri) =
+        begin_login(app, provider, cookies, code, state_override).await;
+    let callback_response =
+        request_with_cookies!(app, test::TestRequest::get().uri(&callback_uri), cookies);
+    OidcLogin {
+        initial_response,
+        callback_response,
+    }
+}
+
 async fn setup_oidc_test_with_paths(
     provider_mutator: impl FnOnce(&mut ProviderState<'_>),
     protected_paths: &[&str],
@@ -336,39 +400,13 @@ async fn setup_oidc_test_with_paths(
     >,
     FakeOidcProvider,
 ) {
-    use sqlpage::{
-        AppState,
-        app_config::{AppConfig, test_database_url},
-    };
     crate::common::init_log();
     let provider = FakeOidcProvider::new();
     provider.with_state_mut(provider_mutator);
-
-    let db_url = test_database_url();
-    let protected_paths = serde_json::to_string(protected_paths).unwrap();
-    let public_paths = serde_json::to_string(public_paths).unwrap();
-    let config_json = format!(
-        r#"{{
-        "database_url": "{db_url}",
-        "max_database_pool_connections": 1,
-        "database_connection_retries": 3,
-        "database_connection_acquire_timeout_seconds": 15,
-        "allow_exec": true,
-        "max_uploaded_file_size": 123456,
-        "listen_on": "127.0.0.1:0",
-        "system_root_ca_certificates": false,
-        "oidc_issuer_url": "{}",
-        "oidc_client_id": "{}",
-        "oidc_client_secret": "{}",
-        "oidc_protected_paths": {protected_paths},
-        "oidc_public_paths": {public_paths},
-        "host": "localhost:1"
-    }}"#,
-        provider.issuer_url, provider.client_id, provider.client_secret
-    );
-
-    let config: AppConfig = serde_json::from_str(&config_json).unwrap();
-    let app_state = AppState::init(&config).await.unwrap();
+    let mut config = oidc_test_config(&provider, protected_paths, public_paths);
+    config.listen_on = Some("127.0.0.1:0".parse().unwrap());
+    config.host = Some("localhost:1".to_string());
+    let app_state = sqlpage::AppState::init(&config).await.unwrap();
     let app = test::init_service(create_app(Data::new(app_state))).await;
     (app, provider)
 }
@@ -398,7 +436,7 @@ async fn test_top_level_builtin_assets_are_accessible_without_login_when_protect
 
     let homepage = request_with_cookies!(app, test::TestRequest::get().uri("/"), cookies);
     assert_ne!(homepage.status(), StatusCode::SEE_OTHER);
-    let homepage = String::from_utf8(test::read_body(homepage).await.to_vec()).unwrap();
+    let homepage = crate::common::read_body_string(homepage).await;
     let script_src = homepage
         .split_once("src=\"/sqlpage.")
         .and_then(|(_, rest)| rest.split_once('"'))
@@ -421,26 +459,17 @@ async fn test_oidc_cached_authorization_redirect_cannot_replay_consumed_state()
     // Reproduces https://github.com/sqlpage/SQLPage/issues/1341: Chrome's
     // private cache can replay a cached 303 without reapplying Set-Cookie
     // headers, causing the browser to retry an already-consumed OIDC state.
-    let initial_response = request_with_cookies!(app, test::TestRequest::get().uri("/"), cookies);
-    let initial_auth_url = Url::parse(
-        initial_response
-            .headers()
-            .get(header::LOCATION)
-            .unwrap()
-            .to_str()
-            .unwrap(),
-    )
-    .unwrap();
+    let (initial_response, initial_auth_url, callback_uri) =
+        begin_login(&app, &provider, &mut cookies, "first-code", None).await;
     let cached_authorization_url =
         permits_storage_after_proxy_adds_freshness(initial_response.headers())
             .then_some(initial_auth_url.clone());
 
-    let state = get_query_param(&initial_auth_url, "state");
     let nonce = get_query_param(&initial_auth_url, "nonce");
-    let redirect_uri = get_query_param(&initial_auth_url, "redirect_uri");
-    let callback_path = Url::parse(&redirect_uri).unwrap().path().to_owned();
-    provider.store_auth_code("first-code".to_string(), nonce.clone());
-    let callback_uri = format!("{callback_path}?code=first-code&state={state}");
+    let callback_path = Url::parse(&get_query_param(&initial_auth_url, "redirect_uri"))
+        .unwrap()
+        .path()
+        .to_owned();
     let callback_response =
         request_with_cookies!(app, test::TestRequest::get().uri(&callback_uri), cookies);
     assert_eq!(callback_response.status(), StatusCode::SEE_OTHER);
@@ -480,27 +509,17 @@ async fn test_oidc_happy_path() {
     let (app, provider) = setup_oidc_test(|_| {}).await;
     let mut cookies: Vec<Cookie<'static>> = Vec::new();
 
-    let resp = request_with_cookies!(app, test::TestRequest::get().uri("/"), cookies);
-    assert_eq!(resp.status(), StatusCode::SEE_OTHER);
+    let login = complete_login(&app, &provider, &mut cookies, "test_auth_code", None).await;
     assert_eq!(
-        resp.headers().get(header::CACHE_CONTROL).unwrap(),
+        login
+            .initial_response
+            .headers()
+            .get(header::CACHE_CONTROL)
+            .unwrap(),
         "no-store",
         "the authorization redirect contains a one-time state and must not be cached"
     );
-    let auth_url = Url::parse(resp.headers().get("location").unwrap().to_str().unwrap()).unwrap();
-
-    let state = get_query_param(&auth_url, "state");
-    let nonce = get_query_param(&auth_url, "nonce");
-    let redirect_uri = get_query_param(&auth_url, "redirect_uri");
-    provider.store_auth_code("test_auth_code".to_string(), nonce);
-
-    let callback_uri = format!(
-        "{}?code=test_auth_code&state={}",
-        Url::parse(&redirect_uri).unwrap().path(),
-        state
-    );
-    let callback_resp =
-        request_with_cookies!(app, test::TestRequest::get().uri(&callback_uri), cookies);
+    let callback_resp = login.callback_response;
     assert_eq!(callback_resp.status(), StatusCode::SEE_OTHER);
     assert_eq!(
         callback_resp.headers().get(header::CACHE_CONTROL).unwrap(),
@@ -530,29 +549,20 @@ async fn test_oidc_happy_path() {
 
 async fn assert_oidc_login_fails(
     provider_mutator: impl FnOnce(&mut ProviderState<'_>),
-    state_override: Option<String>,
+    state_override: Option<&str>,
 ) {
     let (app, provider) = setup_oidc_test(provider_mutator).await;
     let mut cookies: Vec<Cookie<'static>> = Vec::new();
 
-    let resp = request_with_cookies!(app, test::TestRequest::get().uri("/"), cookies);
-    assert_eq!(resp.status(), StatusCode::SEE_OTHER);
-    let auth_url = Url::parse(resp.headers().get("location").unwrap().to_str().unwrap()).unwrap();
-
-    let state = get_query_param(&auth_url, "state");
-    let nonce = get_query_param(&auth_url, "nonce");
-    let redirect_uri = get_query_param(&auth_url, "redirect_uri");
-    provider.store_auth_code("test_auth_code".to_string(), nonce);
-
-    let callback_state = state_override.unwrap_or(state);
-    let callback_uri = format!(
-        "{}?code=test_auth_code&state={}",
-        Url::parse(&redirect_uri).unwrap().path(),
-        callback_state
-    );
-    let callback_resp =
-        request_with_cookies!(app, test::TestRequest::get().uri(&callback_uri), cookies);
-
+    let login = complete_login(
+        &app,
+        &provider,
+        &mut cookies,
+        "test_auth_code",
+        state_override,
+    )
+    .await;
+    let callback_resp = login.callback_response;
     assert_eq!(callback_resp.status(), StatusCode::SEE_OTHER);
     let location = callback_resp
         .headers()
@@ -590,7 +600,7 @@ async fn assert_oidc_callback_fails_with_bad_jwt(
 
 #[actix_web::test]
 async fn test_oidc_csrf_state_mismatch_is_rejected() {
-    assert_oidc_login_fails(|_| {}, Some("wrong_state".to_string())).await;
+    assert_oidc_login_fails(|_| {}, Some("wrong_state")).await;
 }
 
 #[actix_web::test]
@@ -642,9 +652,7 @@ async fn test_repeatedly_failing_callback_stops_redirecting_to_the_provider() {
     let (app, provider) = setup_oidc_test(|_| {}).await;
     let mut cookies: Vec<Cookie<'static>> = Vec::new();
 
-    let resp = request_with_cookies!(app, test::TestRequest::get().uri("/"), cookies);
-    assert_eq!(resp.status(), StatusCode::SEE_OTHER);
-    let auth_url = Url::parse(resp.headers().get("location").unwrap().to_str().unwrap()).unwrap();
+    let (_, auth_url, _) = begin_login(&app, &provider, &mut cookies, "unused-code", None).await;
     let redirect_uri = get_query_param(&auth_url, "redirect_uri");
     let callback_path = Url::parse(&redirect_uri).unwrap().path().to_owned();
     let failing_callback = format!("{callback_path}?code=x&state=wrong_state");
@@ -700,29 +708,12 @@ async fn setup_oidc_test_with_prefix(
     >,
     FakeOidcProvider,
 ) {
-    use sqlpage::{
-        AppState,
-        app_config::{AppConfig, test_database_url},
-    };
     crate::common::init_log();
     let provider = FakeOidcProvider::new();
     provider.with_state_mut(provider_mutator);
-
-    let db_url = test_database_url();
-    let config_json = format!(
-        r#"{{
-        "database_url": "{db_url}",
-        "oidc_issuer_url": "{}",
-        "oidc_client_id": "{}",
-        "oidc_client_secret": "{}",
-        "oidc_protected_paths": ["/"],
-        "site_prefix": "{site_prefix}"
-    }}"#,
-        provider.issuer_url, provider.client_id, provider.client_secret
-    );
-
-    let config: AppConfig = serde_json::from_str(&config_json).unwrap();
-    let app_state = AppState::init(&config).await.unwrap();
+    let mut config = oidc_test_config(&provider, &["/"], &[]);
+    config.site_prefix = site_prefix.to_string();
+    let app_state = sqlpage::AppState::init(&config).await.unwrap();
     let app = test::init_service(create_app(Data::new(app_state))).await;
     (app, provider)
 }
@@ -747,28 +738,12 @@ async fn test_oidc_with_site_prefix() {
 
 #[actix_web::test]
 async fn test_oidc_logout_uses_correct_scheme() {
-    use sqlpage::{
-        AppState,
-        app_config::{AppConfig, test_database_url},
-    };
-
     crate::common::init_log();
     let provider = FakeOidcProvider::new();
 
-    let db_url = test_database_url();
-    let config_json = format!(
-        r#"{{
-        "database_url": "{db_url}",
-        "oidc_issuer_url": "{}",
-        "oidc_client_id": "{}",
-        "oidc_client_secret": "{}",
-        "https_domain": "example.com"
-    }}"#,
-        provider.issuer_url, provider.client_id, provider.client_secret
-    );
-
-    let config: AppConfig = serde_json::from_str(&config_json).unwrap();
-    let app_state = AppState::init(&config).await.unwrap();
+    let mut config = oidc_test_config(&provider, &[], &[]);
+    config.https_domain = Some("example.com".to_string());
+    let app_state = sqlpage::AppState::init(&config).await.unwrap();
     let logout_path = app_state
         .oidc_state
         .as_ref()
@@ -800,21 +775,8 @@ async fn test_slow_discovery_does_not_block_authenticated_requests() {
     let mut cookies: Vec<Cookie<'static>> = Vec::new();
 
     // Complete a full login to get auth cookies
-    let resp = request_with_cookies!(app, test::TestRequest::get().uri("/"), cookies);
-    assert_eq!(resp.status(), StatusCode::SEE_OTHER);
-    let auth_url = Url::parse(resp.headers().get("location").unwrap().to_str().unwrap()).unwrap();
-    let state_param = get_query_param(&auth_url, "state");
-    let nonce = get_query_param(&auth_url, "nonce");
-    let redirect_uri = get_query_param(&auth_url, "redirect_uri");
-    provider.store_auth_code("test_auth_code".to_string(), nonce);
-    let callback_uri = format!(
-        "{}?code=test_auth_code&state={}",
-        Url::parse(&redirect_uri).unwrap().path(),
-        state_param
-    );
-    let callback_resp =
-        request_with_cookies!(app, test::TestRequest::get().uri(&callback_uri), cookies);
-    assert_eq!(callback_resp.status(), StatusCode::SEE_OTHER);
+    let login = complete_login(&app, &provider, &mut cookies, "test_auth_code", None).await;
+    assert_eq!(login.callback_response.status(), StatusCode::SEE_OTHER);
 
     settle_background_refreshes().await;
     let count_before = provider.discovery_count();
@@ -856,22 +818,11 @@ async fn test_slow_token_endpoint_does_not_freeze_server() {
     let (app, provider) = setup_oidc_test(|_| {}).await;
     let mut cookies: Vec<Cookie<'static>> = Vec::new();
 
-    let resp = request_with_cookies!(app, test::TestRequest::get().uri("/"), cookies);
-    assert_eq!(resp.status(), StatusCode::SEE_OTHER);
-    let auth_url = Url::parse(resp.headers().get("location").unwrap().to_str().unwrap()).unwrap();
-    let state_param = get_query_param(&auth_url, "state");
-    let nonce = get_query_param(&auth_url, "nonce");
-    let redirect_uri = get_query_param(&auth_url, "redirect_uri");
-    provider.store_auth_code("test_auth_code".to_string(), nonce);
+    let (_, _, callback_uri) =
+        begin_login(&app, &provider, &mut cookies, "test_auth_code", None).await;
 
     provider.set_token_endpoint_delay(Duration::from_secs(999));
 
-    let callback_uri = format!(
-        "{}?code=test_auth_code&state={}",
-        Url::parse(&redirect_uri).unwrap().path(),
-        state_param
-    );
-
     let handle = tokio::task::spawn_local(async move {
         let mut req = test::TestRequest::get().uri(&callback_uri);
         for cookie in &cookies {
@@ -899,49 +850,19 @@ async fn test_slow_token_endpoint_does_not_freeze_server() {
 /// must keep working.
 #[actix_web::test]
 async fn test_oidc_logout_is_session_bound() {
-    use sqlpage::{
-        AppState,
-        app_config::{AppConfig, test_database_url},
-    };
-
     crate::common::init_log();
     let provider = FakeOidcProvider::new();
 
-    let db_url = test_database_url();
-    let config_json = format!(
-        r#"{{
-        "database_url": "{db_url}",
-        "oidc_issuer_url": "{}",
-        "oidc_client_id": "{}",
-        "oidc_client_secret": "{}",
-        "oidc_protected_paths": ["/"],
-        "host": "localhost:1"
-    }}"#,
-        provider.issuer_url, provider.client_id, provider.client_secret
-    );
-
-    let config: AppConfig = serde_json::from_str(&config_json).unwrap();
-    let app_state = AppState::init(&config).await.unwrap();
+    let mut config = oidc_test_config(&provider, &["/"], &[]);
+    config.host = Some("localhost:1".to_string());
+    let app_state = sqlpage::AppState::init(&config).await.unwrap();
     let oidc_state = app_state.oidc_state.clone().unwrap();
     let app = test::init_service(create_app(Data::new(app_state))).await;
 
     // Complete a full login as the victim.
     let mut cookies: Vec<Cookie<'static>> = Vec::new();
-    let resp = request_with_cookies!(app, test::TestRequest::get().uri("/"), cookies);
-    assert_eq!(resp.status(), StatusCode::SEE_OTHER);
-    let auth_url = Url::parse(resp.headers().get("location").unwrap().to_str().unwrap()).unwrap();
-    let state = get_query_param(&auth_url, "state");
-    let nonce = get_query_param(&auth_url, "nonce");
-    let redirect_uri = get_query_param(&auth_url, "redirect_uri");
-    provider.store_auth_code("test_auth_code".to_string(), nonce);
-    let callback_uri = format!(
-        "{}?code=test_auth_code&state={}",
-        Url::parse(&redirect_uri).unwrap().path(),
-        state
-    );
-    let callback_resp =
-        request_with_cookies!(app, test::TestRequest::get().uri(&callback_uri), cookies);
-    assert_eq!(callback_resp.status(), StatusCode::SEE_OTHER);
+    let login = complete_login(&app, &provider, &mut cookies, "test_auth_code", None).await;
+    assert_eq!(login.callback_response.status(), StatusCode::SEE_OTHER);
 
     let victim_auth = cookies
         .iter()
diff --git a/tests/parameter_binding/mod.rs b/tests/parameter_binding/mod.rs
index 5fe31a4d6..bee65962c 100644
--- a/tests/parameter_binding/mod.rs
+++ b/tests/parameter_binding/mod.rs
@@ -1,10 +1,8 @@
-use actix_web::{http::StatusCode, test};
+use actix_web::http::StatusCode;
 use sqlx::any::AnyKind;
 use sqlx::connection::Connection as _;
 
-use sqlpage::webserver::http::main_handler;
-
-use crate::common::{get_request_to_with_data, make_app_data};
+use crate::common::{make_app_data, response_with_data};
 
 #[actix_web::test]
 async fn test_parameterized_pages_leave_a_prepared_statement_in_the_cache() -> actix_web::Result<()>
@@ -15,15 +13,13 @@ async fn test_parameterized_pages_leave_a_prepared_statement_in_the_cache() -> a
     }
 
     for _ in 0..3 {
-        let req = get_request_to_with_data(
+        let resp = response_with_data(
             "/tests/parameter_binding/echo_parameter.sql?x=1447",
             data.clone(),
         )
-        .await?
-        .to_srv_request();
-        let resp = main_handler(req).await?;
+        .await?;
         assert_eq!(resp.status(), StatusCode::OK);
-        let page = String::from_utf8(test::read_body(resp).await.to_vec()).unwrap();
+        let page = crate::common::read_body_string(resp).await;
         assert!(
             page.contains("1447"),
             "{page}\nexpected the bound parameter to reach the query"
diff --git a/tests/requests/mod.rs b/tests/requests/mod.rs
index bd308f96a..62851ae41 100644
--- a/tests/requests/mod.rs
+++ b/tests/requests/mod.rs
@@ -1,23 +1,25 @@
 use actix_web::{http::StatusCode, test};
 use serde_json::json;
-use sqlpage::webserver::http::main_handler;
 
-use crate::common::get_request_to;
+use crate::common::{multipart_request, request_for, response_for, response_from, send_request};
 
-async fn rendered_page(req: actix_web::dev::ServiceRequest) -> actix_web::Result<String> {
-    let resp = main_handler(req).await?;
+async fn rendered_page(
+    req: test::TestRequest,
+    data: actix_web::web::Data<sqlpage::AppState>,
+) -> actix_web::Result<String> {
+    let resp = send_request(req, data).await?;
     assert_eq!(resp.status(), StatusCode::OK);
-    Ok(String::from_utf8(test::read_body(resp).await.to_vec()).unwrap())
+    Ok(crate::common::read_body_string(resp).await)
 }
 
 #[actix_web::test]
 async fn test_request_body() -> actix_web::Result<()> {
+    let app_data = crate::common::make_app_data().await;
     let page = rendered_page(
-        get_request_to("/tests/requests/request_body_test.sql")
-            .await?
+        request_for("/tests/requests/request_body_test.sql")
             .insert_header(("content-type", "text/plain"))
-            .set_payload("Hello, world!")
-            .to_srv_request(),
+            .set_payload("Hello, world!"),
+        app_data.clone(),
     )
     .await?;
     assert!(
@@ -26,19 +28,17 @@ async fn test_request_body() -> actix_web::Result<()> {
     );
 
     let page = rendered_page(
-        get_request_to("/tests/requests/request_body_test.sql")
-            .await?
+        request_for("/tests/requests/request_body_test.sql")
             .insert_header(("content-type", "application/x-www-form-urlencoded"))
-            .set_payload("key=value")
-            .to_srv_request(),
+            .set_payload("key=value"),
+        app_data.clone(),
     )
     .await?;
     assert!(page.contains("NULL"), "{page}\nexpected NULL for form data");
 
     let page = rendered_page(
-        get_request_to("/tests/requests/request_body_test.sql")
-            .await?
-            .to_srv_request(),
+        request_for("/tests/requests/request_body_test.sql"),
+        app_data,
     )
     .await?;
     assert!(
@@ -53,13 +53,13 @@ async fn test_request_body_base64() -> actix_web::Result<()> {
     let binary_data = (0u8..=255u8).collect::<Vec<_>>();
     let expected_base64 =
         base64::Engine::encode(&base64::engine::general_purpose::STANDARD, &binary_data);
+    let app_data = crate::common::make_app_data().await;
 
     let page = rendered_page(
-        get_request_to("/tests/requests/request_body_base64_test.sql")
-            .await?
+        request_for("/tests/requests/request_body_base64_test.sql")
             .insert_header(("content-type", "application/octet-stream"))
-            .set_payload(binary_data)
-            .to_srv_request(),
+            .set_payload(binary_data),
+        app_data.clone(),
     )
     .await?;
     assert!(
@@ -68,19 +68,17 @@ async fn test_request_body_base64() -> actix_web::Result<()> {
     );
 
     let page = rendered_page(
-        get_request_to("/tests/requests/request_body_base64_test.sql")
-            .await?
+        request_for("/tests/requests/request_body_base64_test.sql")
             .insert_header(("content-type", "application/x-www-form-urlencoded"))
-            .set_payload("key=value")
-            .to_srv_request(),
+            .set_payload("key=value"),
+        app_data.clone(),
     )
     .await?;
     assert!(page.contains("NULL"), "{page}\nexpected NULL for form data");
 
     let page = rendered_page(
-        get_request_to("/tests/requests/request_body_base64_test.sql")
-            .await?
-            .to_srv_request(),
+        request_for("/tests/requests/request_body_base64_test.sql"),
+        app_data,
     )
     .await?;
     assert!(
@@ -92,10 +90,7 @@ async fn test_request_body_base64() -> actix_web::Result<()> {
 
 #[actix_web::test]
 async fn test_download_data_url() -> actix_web::Result<()> {
-    let req = get_request_to("/tests/requests/request_download_test.sql")
-        .await?
-        .to_srv_request();
-    let resp = main_handler(req).await?;
+    let resp = response_for("/tests/requests/request_download_test.sql").await;
 
     assert_eq!(resp.status(), StatusCode::OK);
     let ct = resp.headers().get("content-type").unwrap();
@@ -113,15 +108,12 @@ async fn test_download_data_url() -> actix_web::Result<()> {
 #[actix_web::test]
 async fn test_large_form_field_roundtrip() -> actix_web::Result<()> {
     let long_string = "a".repeat(123_454);
-    let req = get_request_to("/tests/components/display_form_field.sql")
-        .await?
+    let req = request_for("/tests/components/display_form_field.sql")
         .insert_header(("content-type", "application/x-www-form-urlencoded"))
-        .set_payload(["x=", &long_string].concat()) // total size is 123454 + 2 = 123456 bytes
-        .to_srv_request();
-    let resp = main_handler(req).await?;
+        .set_payload(["x=", &long_string].concat()); // total size is 123454 + 2 = 123456 bytes
+    let resp = response_from(req).await?;
     assert_eq!(resp.status(), StatusCode::OK);
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert!(
         !body_str.contains("error"),
         "{body_str}\nshouldn't have errors"
@@ -135,15 +127,13 @@ async fn test_large_form_field_roundtrip() -> actix_web::Result<()> {
 
 #[actix_web::test]
 async fn test_variables_function() -> actix_web::Result<()> {
-    let url = "/tests/requests/variables.sql?common=get_value&get_only=get_val";
-    let req_body = "common=post_value&post_only=post_val";
-    let req = get_request_to(url)
-        .await?
+    let url = "/tests/requests/variables.sql?common=get_value&get_only=get_val&array[]=get_a&array[]=get_b";
+    let req_body = "common=post_value&post_only=post_val&array[]=post_a&array[]=post_b";
+    let req = request_for(url)
         .insert_header(("content-type", "application/x-www-form-urlencoded"))
         .insert_header(("accept", "application/json"))
-        .set_payload(req_body)
-        .to_srv_request();
-    let resp = main_handler(req).await?;
+        .set_payload(req_body);
+    let resp = response_from(req).await?;
 
     assert_eq!(resp.status(), StatusCode::OK);
     let body_json: serde_json::Value = test::read_body_json(resp).await;
@@ -152,30 +142,30 @@ async fn test_variables_function() -> actix_web::Result<()> {
         [
             (
                 "all_vars",
-                json!({"get_only": "get_val", "common": "get_value", "post_only": "post_val", "common": "post_value"}),
+                json!({"get_only": "get_val", "common": "post_value", "post_only": "post_val", "array": ["post_a", "post_b"]}),
             ),
             (
                 "get_vars",
-                json!({"get_only": "get_val", "common": "get_value"}),
+                json!({"get_only": "get_val", "common": "get_value", "array": ["get_a", "get_b"]}),
             ),
             (
                 "post_vars",
-                json!({"post_only": "post_val", "common": "post_value"}),
+                json!({"post_only": "post_val", "common": "post_value", "array": ["post_a", "post_b"]}),
             ),
             ("set_vars", json!({})),
         ],
         [
             (
                 "all_vars",
-                json!({"get_only": "get_val", "common": "set_common_value", "post_only": "post_val", "my_set_var": "set_value"}),
+                json!({"get_only": "get_val", "common": "set_common_value", "post_only": "post_val", "my_set_var": "set_value", "array": ["post_a", "post_b"]}),
             ),
             (
                 "get_vars",
-                json!({"get_only": "get_val", "common": "get_value"}),
+                json!({"get_only": "get_val", "common": "get_value", "array": ["get_a", "get_b"]}),
             ),
             (
                 "post_vars",
-                json!({"post_only": "post_val", "common": "post_value"}),
+                json!({"post_only": "post_val", "common": "post_value", "array": ["post_a", "post_b"]}),
             ),
             (
                 "set_vars",
@@ -184,9 +174,17 @@ async fn test_variables_function() -> actix_web::Result<()> {
         ],
     ];
 
+    let mut null_step = expected[1].clone();
+    null_step[0].1["common"] = json!(null);
+    null_step[3].1["common"] = json!(null);
     let actual_array = body_json.as_array().expect("response is nota json array");
-    for (i, expected_step) in expected.into_iter().enumerate() {
+    assert_eq!(actual_array.len(), expected.len() + 1);
+    for (i, expected_step) in expected.into_iter().chain([null_step]).enumerate() {
         let actual = &actual_array[i];
+        assert!(actual["missing"].is_null());
+        assert!(actual["post_only_compat"].is_null());
+        assert_eq!(actual["get_array_lookup"], r#"["get_a","get_b"]"#);
+        assert_eq!(actual["post_array_lookup"], r#"["post_a","post_b"]"#);
         for (key, expected_value) in expected_step {
             let actual_decoded: serde_json::Value =
                 serde_json::from_str(actual[key].as_str().unwrap()).unwrap();
@@ -202,20 +200,17 @@ async fn test_variables_function() -> actix_web::Result<()> {
 
 #[actix_web::test]
 async fn test_invalid_utf8_multipart_text_field_returns_bad_request() -> actix_web::Result<()> {
-    let req = get_request_to("/tests/requests/variables.sql")
-        .await?
-        .insert_header(("content-type", "multipart/form-data; boundary=1234567890"))
-        .set_payload(
-            b"--1234567890\r\n\
+    let req = multipart_request(
+        "/tests/requests/variables.sql",
+        b"--1234567890\r\n\
             Content-Disposition: form-data; name=\"x\"\r\n\
             Content-Type: text/plain\r\n\
             \r\n\
             \xff\r\n\
             --1234567890--\r\n"
-                .as_slice(),
-        )
-        .to_srv_request();
-    let status = match main_handler(req).await {
+            .as_slice(),
+    );
+    let status = match response_from(req).await {
         Ok(resp) => resp.status(),
         Err(err) => err.as_response_error().status_code(),
     };
@@ -231,19 +226,16 @@ async fn test_invalid_utf8_multipart_text_field_returns_bad_request() -> actix_w
 
 #[actix_web::test]
 async fn test_missing_multipart_content_disposition_returns_bad_request() -> actix_web::Result<()> {
-    let req = get_request_to("/tests/requests/variables.sql")
-        .await?
-        .insert_header(("content-type", "multipart/form-data; boundary=1234567890"))
-        .set_payload(
-            b"--1234567890\r\n\
+    let req = multipart_request(
+        "/tests/requests/variables.sql",
+        b"--1234567890\r\n\
             Content-Type: text/plain\r\n\
             \r\n\
             hello\r\n\
             --1234567890--\r\n"
-                .as_slice(),
-        )
-        .to_srv_request();
-    let status = match main_handler(req).await {
+            .as_slice(),
+    );
+    let status = match response_from(req).await {
         Ok(resp) => resp.status(),
         Err(err) => err.as_response_error().status_code(),
     };
diff --git a/tests/requests/variables.sql b/tests/requests/variables.sql
index 4f9bf5ca6..ec9c9d84b 100644
--- a/tests/requests/variables.sql
+++ b/tests/requests/variables.sql
@@ -2,7 +2,9 @@ select
        sqlpage.variables() as all_vars,
        sqlpage.variables('get') as get_vars,
        sqlpage.variables('post') as post_vars,
-       sqlpage.variables('set') as set_vars;
+       sqlpage.variables('set') as set_vars,
+       $absent as missing, $post_only as post_only_compat,
+       $array as get_array_lookup, :array as post_array_lookup;
 
 set my_set_var = 'set_value';
 set common = 'set_common_value';
@@ -11,4 +13,12 @@ select
        sqlpage.variables() as all_vars,
        sqlpage.variables('get') as get_vars,
        sqlpage.variables('post') as post_vars,
-       sqlpage.variables('set') as set_vars;
+       sqlpage.variables('set') as set_vars,
+       $absent as missing, $post_only as post_only_compat,
+       $array as get_array_lookup, :array as post_array_lookup;
+
+set common = NULL;
+select sqlpage.variables() as all_vars, sqlpage.variables('get') as get_vars,
+       sqlpage.variables('post') as post_vars, sqlpage.variables('set') as set_vars,
+       $absent as missing, $post_only as post_only_compat,
+       $array as get_array_lookup, :array as post_array_lookup;
diff --git a/tests/requests/webhook_hmac.rs b/tests/requests/webhook_hmac.rs
index a5af9dd87..02c0432c1 100644
--- a/tests/requests/webhook_hmac.rs
+++ b/tests/requests/webhook_hmac.rs
@@ -1,26 +1,30 @@
 use actix_web::{http::StatusCode, test};
-use sqlpage::webserver::http::main_handler;
 
-use crate::common::get_request_to;
+use crate::common::{request_for, response_from};
 
-#[actix_web::test]
-async fn test_webhook_hmac_invalid_signature() -> actix_web::Result<()> {
+/// Builds a webhook validation request, optionally signed with `signature`.
+/// Sets `WEBHOOK_SECRET` so every test signs against the same secret.
+async fn webhook_request(
+    signature: Option<&str>,
+) -> actix_web::Result<actix_web::dev::ServiceResponse> {
     // Set up environment variable for webhook secret
     unsafe {
         std::env::set_var("WEBHOOK_SECRET", "test-secret-key");
     }
 
     let webhook_body = r#"{"order_id":12345,"total":"99.99"}"#;
-    let invalid_signature = "96a5f6f65c85a2d4d1f3a37813ab2c0b44041bdc17691fbb0884e3eb52b7c54b";
-
-    let req = get_request_to("/tests/webhook_hmac_validation.sql")
-        .await?
-        .insert_header(("content-type", "application/json"))
-        .insert_header(("X-Webhook-Signature", invalid_signature))
-        .set_payload(webhook_body)
-        .to_srv_request();
+    let mut req = request_for("/tests/webhook_hmac_validation.sql")
+        .insert_header(("content-type", "application/json"));
+    if let Some(signature) = signature {
+        req = req.insert_header(("X-Webhook-Signature", signature));
+    }
+    response_from(req.set_payload(webhook_body)).await
+}
 
-    let resp = main_handler(req).await?;
+#[actix_web::test]
+async fn test_webhook_hmac_invalid_signature() -> actix_web::Result<()> {
+    let invalid_signature = "96a5f6f65c85a2d4d1f3a37813ab2c0b44041bdc17691fbb0884e3eb52b7c54b";
+    let resp = webhook_request(Some(invalid_signature)).await?;
 
     // Should redirect to error page when signature is invalid
     assert!(
@@ -41,22 +45,8 @@ async fn test_webhook_hmac_invalid_signature() -> actix_web::Result<()> {
 
 #[actix_web::test]
 async fn test_webhook_hmac_valid_signature() -> actix_web::Result<()> {
-    // Set up environment variable for webhook secret
-    unsafe {
-        std::env::set_var("WEBHOOK_SECRET", "test-secret-key");
-    }
-
-    let webhook_body = r#"{"order_id":12345,"total":"99.99"}"#;
     let valid_signature = "260b3b5ead84843645588af82d5d2c3fe24c598a950d36c45438c3a5f5bb941c";
-
-    let req = get_request_to("/tests/webhook_hmac_validation.sql")
-        .await?
-        .insert_header(("content-type", "application/json"))
-        .insert_header(("X-Webhook-Signature", valid_signature))
-        .set_payload(webhook_body)
-        .to_srv_request();
-
-    let resp = main_handler(req).await?;
+    let resp = webhook_request(Some(valid_signature)).await?;
 
     // Should return success when signature is valid
     assert_eq!(resp.status(), StatusCode::OK, "200 resp for signed req");
@@ -71,21 +61,8 @@ async fn test_webhook_hmac_valid_signature() -> actix_web::Result<()> {
 
 #[actix_web::test]
 async fn test_webhook_hmac_missing_signature() -> actix_web::Result<()> {
-    // Set up environment variable for webhook secret
-    unsafe {
-        std::env::set_var("WEBHOOK_SECRET", "test-secret-key");
-    }
-
-    let webhook_body = r#"{"order_id":12345,"total":"99.99"}"#;
-
     // Don't include the X-Webhook-Signature header
-    let req = get_request_to("/tests/webhook_hmac_validation.sql")
-        .await?
-        .insert_header(("content-type", "application/json"))
-        .set_payload(webhook_body)
-        .to_srv_request();
-
-    let resp = main_handler(req).await?;
+    let resp = webhook_request(None).await?;
 
     let location = resp
         .headers()
diff --git a/tests/server_timing/mod.rs b/tests/server_timing/mod.rs
index 6d0a42faa..6630c4d10 100644
--- a/tests/server_timing/mod.rs
+++ b/tests/server_timing/mod.rs
@@ -1,21 +1,28 @@
 use actix_web::http::StatusCode;
-use sqlpage::webserver::http::main_handler;
+use sqlpage::app_config::{AppConfig, DevOrProd};
 
-use crate::common::{get_request_to, make_app_data_from_config, test_config};
+use crate::common::{response_for, response_with, test_config};
+
+/// Returns the value of the `Server-Timing` response header, failing the test
+/// when the header is missing.
+fn server_timing_header(resp: &actix_web::dev::ServiceResponse) -> &str {
+    resp.headers()
+        .get("Server-Timing")
+        .expect("Server-Timing header should be present")
+        .to_str()
+        .unwrap()
+}
 
 #[actix_web::test]
 async fn test_server_timing_disabled_in_production() -> actix_web::Result<()> {
-    let mut config = test_config();
-    config.environment = sqlpage::app_config::DevOrProd::Production;
-    let app_data = make_app_data_from_config(config).await;
-
-    let req = crate::common::get_request_to_with_data(
+    let resp = response_with(
         "/tests/sql_test_files/component_rendering/simple.sql",
-        app_data,
+        AppConfig {
+            environment: DevOrProd::Production,
+            ..test_config()
+        },
     )
-    .await?
-    .to_srv_request();
-    let resp = main_handler(req).await?;
+    .await?;
 
     assert_eq!(resp.status(), StatusCode::OK);
     assert!(
@@ -27,59 +34,34 @@ async fn test_server_timing_disabled_in_production() -> actix_web::Result<()> {
 
 #[actix_web::test]
 async fn test_server_timing_enabled_in_development() -> actix_web::Result<()> {
-    let mut config = test_config();
-    config.environment = sqlpage::app_config::DevOrProd::Development;
-    let app_data = make_app_data_from_config(config).await;
-
-    let req = crate::common::get_request_to_with_data(
+    let resp = response_with(
         "/tests/sql_test_files/data/postgres_cast_syntax.sql",
-        app_data,
+        AppConfig {
+            environment: DevOrProd::Development,
+            ..test_config()
+        },
     )
-    .await?
-    .to_srv_request();
-    let resp = main_handler(req).await?;
+    .await?;
 
     assert_eq!(resp.status(), StatusCode::OK);
-    let server_timing_header = resp
-        .headers()
-        .get("Server-Timing")
-        .expect("Server-Timing header should be present in development mode");
-    let header_value = server_timing_header.to_str().unwrap();
+    let header_value = server_timing_header(&resp);
 
-    assert!(
-        header_value.contains("sql_file;dur="),
-        "Should contain sql_file timing: {header_value}"
-    );
-    assert!(
-        header_value.contains("parse_req;dur="),
-        "Should contain parse_req timing: {header_value}"
-    );
-    assert!(
-        header_value.contains("bind_params;dur="),
-        "Should contain bind_params timing: {header_value}"
-    );
-    assert!(
-        header_value.contains("db_conn;dur="),
-        "Should contain db_conn timing: {header_value}"
-    );
-    assert!(
-        header_value.contains("row;dur="),
-        "Should contain row timing: {header_value}"
-    );
+    for token in ["sql_file", "parse_req", "bind_params", "db_conn", "row"] {
+        assert!(
+            header_value.contains(&format!("{token};dur=")),
+            "Should contain {token} timing: {header_value}"
+        );
+    }
 
     Ok(())
 }
 
 #[actix_web::test]
 async fn test_server_timing_format() -> actix_web::Result<()> {
-    let req = get_request_to("/tests/sql_test_files/data/postgres_cast_syntax.sql")
-        .await?
-        .to_srv_request();
-    let resp = main_handler(req).await?;
+    let resp = response_for("/tests/sql_test_files/data/postgres_cast_syntax.sql").await;
 
     assert_eq!(resp.status(), StatusCode::OK);
-    let server_timing_header = resp.headers().get("Server-Timing").unwrap();
-    let header_value = server_timing_header.to_str().unwrap();
+    let header_value = server_timing_header(&resp);
 
     let parts: Vec<&str> = header_value.split(", ").collect();
     assert!(parts.len() >= 5, "Should have at least 5 timing events");
@@ -105,26 +87,21 @@ async fn test_server_timing_format() -> actix_web::Result<()> {
 
 #[actix_web::test]
 async fn test_server_timing_in_redirect() -> actix_web::Result<()> {
-    let mut config = test_config();
-    config.environment = sqlpage::app_config::DevOrProd::Development;
-    let app_data = make_app_data_from_config(config).await;
-
-    let req =
-        crate::common::get_request_to_with_data("/tests/server_timing/redirect_test.sql", app_data)
-            .await?
-            .to_srv_request();
-    let resp = main_handler(req).await?;
+    let resp = response_with(
+        "/tests/server_timing/redirect_test.sql",
+        AppConfig {
+            environment: DevOrProd::Development,
+            ..test_config()
+        },
+    )
+    .await?;
 
     assert_eq!(
         resp.status(),
         StatusCode::FOUND,
         "Response should be a redirect"
     );
-    let server_timing_header = resp
-        .headers()
-        .get("Server-Timing")
-        .expect("Server-Timing header should be present in redirect responses");
-    let header_value = server_timing_header.to_str().unwrap();
+    let header_value = server_timing_header(&resp);
 
     assert!(
         !header_value.is_empty(),
diff --git a/tests/sql_test_files/data/immutable_variables.sql b/tests/sql_test_files/data/immutable_variables.sql
index 2fe3285c1..31d82d021 100644
--- a/tests/sql_test_files/data/immutable_variables.sql
+++ b/tests/sql_test_files/data/immutable_variables.sql
@@ -8,3 +8,9 @@ select '"x":"set_value"' as expected_contains, sqlpage.variables('set') as actua
 select '"set_only":"only_in_set"' as expected_contains, sqlpage.variables('set') as actual;
 select '"x":"set_value"' as expected_contains, sqlpage.variables() as actual;
 select '"set_only":"only_in_set"' as expected_contains, sqlpage.variables() as actual;
+
+-- The fixture runner provides ?x=1. SET NULL suppresses $x but leaves GET enumeration immutable.
+set x = NULL;
+select NULL as expected, $x as actual;
+select '"x":null' as expected_contains, sqlpage.variables() as actual;
+select '"x":"1"' as expected_contains, sqlpage.variables('get') as actual;
diff --git a/tests/sql_test_files/data/run_sql_variable_isolation.sql b/tests/sql_test_files/data/run_sql_variable_isolation.sql
new file mode 100644
index 000000000..77ef2cf32
--- /dev/null
+++ b/tests/sql_test_files/data/run_sql_variable_isolation.sql
@@ -0,0 +1,8 @@
+set scope = 'parent';
+set child_rows = sqlpage.run_sql('tests/sql_test_files/variable_scope_child.sql');
+select '"inherited":"parent"' as expected_contains, $child_rows as actual;
+select '"changed":"child"' as expected_contains, $child_rows as actual;
+select 'parent' as expected, $scope as actual;
+set child_rows = sqlpage.run_sql('tests/sql_test_files/variable_scope_child.sql', '{"scope":null}');
+select '"inherited":null' as expected_contains, $child_rows as actual;
+select 'parent' as expected, $scope as actual;
diff --git a/tests/sql_test_files/mod.rs b/tests/sql_test_files/mod.rs
index c8cf53f32..be7eb7b76 100644
--- a/tests/sql_test_files/mod.rs
+++ b/tests/sql_test_files/mod.rs
@@ -131,13 +131,21 @@ async fn run_sql_test(
 
     let use_json = matches!(test_case.format, SqlTestFormat::Json);
 
-    let resp = tokio::time::timeout(Duration::from_secs(5), async {
-        if use_json {
-            crate::common::req_path_with_app_data_json(&req_str, app_data.clone()).await
-        } else {
-            crate::common::req_path_with_app_data(&req_str, app_data.clone()).await
-        }
-    })
+    let request = crate::common::request_for(&req_str)
+        .insert_header(("cookie", "test_cook=123"))
+        .insert_header(("authorization", "Basic dGVzdDp0ZXN0"))
+        .insert_header((
+            "accept",
+            if use_json {
+                "application/json"
+            } else {
+                "text/html"
+            },
+        ));
+    let resp = tokio::time::timeout(
+        Duration::from_secs(5),
+        crate::common::send_request(request, app_data.clone()),
+    )
     .await
     .unwrap_or_else(|_| panic!("Test timeout: {}", test_file.display()))
     .unwrap_or_else(|e| panic!("Request failed: {}: {}", test_file.display(), e));
diff --git a/tests/sql_test_files/variable_scope_child.sql b/tests/sql_test_files/variable_scope_child.sql
new file mode 100644
index 000000000..20689fe52
--- /dev/null
+++ b/tests/sql_test_files/variable_scope_child.sql
@@ -0,0 +1,3 @@
+select $scope as inherited;
+set scope = 'child';
+select $scope as changed;
diff --git a/tests/transactions/mod.rs b/tests/transactions/mod.rs
index 3718f09bf..e0e3cf324 100644
--- a/tests/transactions/mod.rs
+++ b/tests/transactions/mod.rs
@@ -1,7 +1,7 @@
-use actix_web::{http::StatusCode, test};
-use sqlpage::webserver::{database::SupportedDatabase, http::main_handler};
+use actix_web::http::StatusCode;
+use sqlpage::webserver::database::SupportedDatabase;
 
-use crate::common::{get_request_to_with_data, make_app_data};
+use crate::common::{make_app_data, multipart_request, response_with_data, send_request};
 
 #[actix_web::test]
 async fn test_transaction_error() -> actix_web::Result<()> {
@@ -14,13 +14,9 @@ async fn test_transaction_error() -> actix_web::Result<()> {
         }
         _ => "/tests/transactions/failed_transaction.sql",
     };
-    let req = get_request_to_with_data(path, data.clone())
-        .await?
-        .to_srv_request();
-    let resp = main_handler(req).await?;
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec())
-        .unwrap()
+    let resp = response_with_data(path, data.clone()).await?;
+    let body_str = crate::common::read_body_string(resp)
+        .await
         .to_ascii_lowercase();
     assert!(
         body_str.contains("error") && body_str.contains("null"),
@@ -28,12 +24,8 @@ async fn test_transaction_error() -> actix_web::Result<()> {
     );
     // Now query again, with ?x=1447
     let path_with_param = path.to_string() + "?x=1447";
-    let req = get_request_to_with_data(&path_with_param, data.clone())
-        .await?
-        .to_srv_request();
-    let resp = main_handler(req).await?;
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let resp = response_with_data(&path_with_param, data.clone()).await?;
+    let body_str = crate::common::read_body_string(resp).await;
     assert!(
         body_str.contains("1447"),
         "{body_str}\nexpected to contain: 1447"
@@ -45,33 +37,28 @@ async fn test_transaction_error() -> actix_web::Result<()> {
 async fn test_failed_copy_followed_by_query() -> actix_web::Result<()> {
     let app_data = make_app_data().await;
     let big_csv = "col1,col2\nval1,val2\n".repeat(1000);
-    let req = get_request_to_with_data(
+    let req = multipart_request(
         "/tests/sql_test_files/component_rendering/error_failed_to_import_the_csv.sql",
-        app_data.clone(),
-    )
-    .await?
-        .insert_header(("content-type", "multipart/form-data; boundary=1234567890"))
-        .set_payload(format!(
+        format!(
             "--1234567890\r\n\
             Content-Disposition: form-data; name=\"recon_csv_file_input\"; filename=\"data.csv\"\r\n\
             Content-Type: text/csv\r\n\
             \r\n\
             {big_csv}\r\n\
             --1234567890--\r\n"
-        ))
-        .to_srv_request();
-    let resp = main_handler(req).await?;
+        ),
+    );
+    let resp = send_request(req, app_data.clone()).await?;
 
     assert_eq!(resp.status(), StatusCode::OK);
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert!(
         body_str.contains("error"),
         "{body_str}\nexpected to contain error message"
     );
 
     // On postgres, the error message should contain  "The postgres COPY FROM STDIN command failed"
-    if matches!(app_data.db.to_string().to_lowercase().as_str(), "postgres") {
+    if crate::common::supports_database(&app_data.db, &[SupportedDatabase::Postgres]) {
         assert!(
             body_str.contains("The postgres COPY FROM STDIN command failed"),
             "{body_str}\nexpected to contain: The postgres COPY FROM STDIN command failed"
@@ -83,14 +70,10 @@ async fn test_failed_copy_followed_by_query() -> actix_web::Result<()> {
         "/tests/sql_test_files/component_rendering/text_markdown.sql",
         "/tests/sql_test_files/component_rendering/text_unsafe_markdown.sql",
     ] {
-        let req = get_request_to_with_data(path, app_data.clone())
-            .await?
-            .to_srv_request();
-        let resp = main_handler(req).await?;
+        let resp = response_with_data(path, app_data.clone()).await?;
 
         assert_eq!(resp.status(), StatusCode::OK);
-        let body = test::read_body(resp).await;
-        let body_str = String::from_utf8(body.to_vec()).unwrap();
+        let body_str = crate::common::read_body_string(resp).await;
         assert!(
             body_str.contains("It works !"),
             "{body_str}\nexpected to contain: It works !"
diff --git a/tests/uploads/mod.rs b/tests/uploads/mod.rs
index fe30cd54e..9975d6acf 100644
--- a/tests/uploads/mod.rs
+++ b/tests/uploads/mod.rs
@@ -1,26 +1,21 @@
 use actix_web::{http::StatusCode, test};
-use sqlpage::webserver::http::main_handler;
 
-use crate::common::get_request_to;
+use crate::common::{multipart_request, response_from};
 
 async fn test_file_upload(target: &str) -> actix_web::Result<()> {
-    let req = get_request_to(target)
-        .await?
-        .insert_header(("content-type", "multipart/form-data; boundary=1234567890"))
-        .set_payload(
-            "--1234567890\r\n\
+    let resp = response_from(multipart_request(
+        target,
+        "--1234567890\r\n\
             Content-Disposition: form-data; name=\"my_file\"; filename=\"testfile.txt\"\r\n\
             Content-Type: text/plain\r\n\
             \r\n\
             Hello, world!\r\n\
             --1234567890--\r\n",
-        )
-        .to_srv_request();
-    let resp = main_handler(req).await?;
+    ))
+    .await?;
 
     assert_eq!(resp.status(), StatusCode::OK);
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert!(
         body_str.contains("Hello, world!"),
         "{body_str}\nexpected to contain: Hello, world!"
@@ -30,15 +25,9 @@ async fn test_file_upload(target: &str) -> actix_web::Result<()> {
 
 #[actix_web::test]
 async fn test_persist_uploaded_file_mode() -> actix_web::Result<()> {
-    let app_data = crate::common::make_app_data().await;
-    let req = test::TestRequest::get()
-        .uri("/tests/uploads/persist_with_mode.sql?mode=644")
-        .app_data(app_data.clone())
-        .app_data(sqlpage::webserver::http::payload_config(&app_data))
-        .app_data(sqlpage::webserver::http::form_config(&app_data))
-        .insert_header((actix_web::http::header::ACCEPT, "application/json"))
-        .insert_header(("content-type", "multipart/form-data; boundary=1234567890"))
-        .set_payload(
+    let resp = response_from(
+        multipart_request(
+            "/tests/uploads/persist_with_mode.sql?mode=644",
             "--1234567890\r\n\
             Content-Disposition: form-data; name=\"my_file\"; filename=\"test.txt\"\r\n\
             Content-Type: text/plain\r\n\
@@ -46,8 +35,9 @@ async fn test_persist_uploaded_file_mode() -> actix_web::Result<()> {
             Hello\r\n\
             --1234567890--\r\n",
         )
-        .to_srv_request();
-    let resp = main_handler(req).await?;
+        .insert_header(("accept", "application/json")),
+    )
+    .await?;
 
     assert_eq!(resp.status(), StatusCode::OK);
     let body_json: serde_json::Value = test::read_body_json(resp).await;
@@ -96,23 +86,19 @@ async fn test_file_upload_through_runsql() -> actix_web::Result<()> {
 
 #[actix_web::test]
 async fn test_blank_file_upload_field() -> actix_web::Result<()> {
-    let req = get_request_to("/tests/uploads/upload_file_test.sql")
-        .await?
-        .insert_header(("content-type", "multipart/form-data; boundary=1234567890"))
-        .set_payload(
-            "--1234567890\r\n\
-            Content-Disposition: form-data; name=\"my_file\"; filename=\"\"\r\n\
-            Content-Type: application/octet-stream\r\n\
-            \r\n\
-            \r\n\
-            --1234567890--\r\n",
-        )
-        .to_srv_request();
-    let resp = main_handler(req).await?;
+    let resp = response_from(multipart_request(
+        "/tests/uploads/upload_file_test.sql",
+        "--1234567890\r\n\
+        Content-Disposition: form-data; name=\"my_file\"; filename=\"\"\r\n\
+        Content-Type: application/octet-stream\r\n\
+        \r\n\
+        \r\n\
+        --1234567890--\r\n",
+    ))
+    .await?;
 
     assert_eq!(resp.status(), StatusCode::OK);
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert!(
         body_str.contains("No file uploaded"),
         "{body_str}\nexpected to contain: No file uploaded"
@@ -122,25 +108,21 @@ async fn test_blank_file_upload_field() -> actix_web::Result<()> {
 
 #[actix_web::test]
 async fn test_file_upload_too_large() -> actix_web::Result<()> {
-    let req = get_request_to("/tests/uploads/upload_file_test.sql")
-        .await?
-        .insert_header(("content-type", "multipart/form-data; boundary=1234567890"))
-        .set_payload(
-            "--1234567890\r\n\
-            Content-Disposition: form-data; name=\"my_file\"; filename=\"testfile.txt\"\r\n\
-            Content-Type: text/plain\r\n\
-            \r\n\
-            "
-            .to_string()
-                + "a".repeat(123_457).as_str()
-                + "\r\n\
-            --1234567890--\r\n",
-        )
-        .to_srv_request();
-    let err_str = main_handler(req)
-        .await
-        .expect_err("Expected an error response")
-        .to_string();
+    let err_str = response_from(multipart_request(
+        "/tests/uploads/upload_file_test.sql",
+        "--1234567890\r\n\
+        Content-Disposition: form-data; name=\"my_file\"; filename=\"testfile.txt\"\r\n\
+        Content-Type: text/plain\r\n\
+        \r\n\
+        "
+        .to_string()
+            + "a".repeat(123_457).as_str()
+            + "\r\n\
+        --1234567890--\r\n",
+    ))
+    .await
+    .expect_err("Expected an error response")
+    .to_string();
     let msg = "max file size";
     assert!(
         err_str.to_ascii_lowercase().contains(msg),
@@ -151,69 +133,57 @@ async fn test_file_upload_too_large() -> actix_web::Result<()> {
 
 #[actix_web::test]
 async fn test_upload_file_data_url() -> actix_web::Result<()> {
-    let req = get_request_to("/tests/uploads/upload_file_data_url_test.sql")
-        .await?
-        .insert_header(("content-type", "multipart/form-data; boundary=1234567890"))
-        .set_payload(
-            "--1234567890\r\n\
-            Content-Disposition: form-data; name=\"my_file\"; filename=\"testfile.txt\"\r\n\
-            Content-Type: image/svg+xml\r\n\
-            \r\n\
-            <svg></svg>\r\n\
-            --1234567890--\r\n",
-        )
-        .to_srv_request();
-    let resp = main_handler(req).await?;
+    let resp = response_from(multipart_request(
+        "/tests/uploads/upload_file_data_url_test.sql",
+        "--1234567890\r\n\
+        Content-Disposition: form-data; name=\"my_file\"; filename=\"testfile.txt\"\r\n\
+        Content-Type: image/svg+xml\r\n\
+        \r\n\
+        <svg></svg>\r\n\
+        --1234567890--\r\n",
+    ))
+    .await?;
     assert_eq!(resp.status(), StatusCode::OK);
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert_eq!(body_str, "data:image/svg+xml;base64,PHN2Zz48L3N2Zz4=");
     Ok(())
 }
 
 #[actix_web::test]
 async fn test_uploaded_file_name() -> actix_web::Result<()> {
-    let req = get_request_to("/tests/uploads/uploaded_file_name_test.sql")
-        .await?
-        .insert_header(("content-type", "multipart/form-data; boundary=1234567890"))
-        .set_payload(
-            "--1234567890\r\n\
-            Content-Disposition: form-data; name=\"my_file\"; filename=\"testfile.txt\"\r\n\
-            Content-Type: text/plain\r\n\
-            \r\n\
-            Some plain text.\r\n\
-            --1234567890--\r\n",
-        )
-        .to_srv_request();
-    let resp = main_handler(req).await?;
+    let resp = response_from(multipart_request(
+        "/tests/uploads/uploaded_file_name_test.sql",
+        "--1234567890\r\n\
+        Content-Disposition: form-data; name=\"my_file\"; filename=\"testfile.txt\"\r\n\
+        Content-Type: text/plain\r\n\
+        \r\n\
+        Some plain text.\r\n\
+        --1234567890--\r\n",
+    ))
+    .await?;
     assert_eq!(resp.status(), StatusCode::OK);
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert_eq!(body_str, "testfile.txt");
     Ok(())
 }
 
 #[actix_web::test]
 async fn test_csv_upload() -> actix_web::Result<()> {
-    let req = get_request_to("/tests/uploads/upload_csv_test.sql")
-        .await?
-        .insert_header(("content-type", "multipart/form-data; boundary=1234567890"))
-        .set_payload(
-            "--1234567890\r\n\
-            Content-Disposition: form-data; name=\"people_file\"; filename=\"people.csv\"\r\n\
-            Content-Type: text/csv\r\n\
-            \r\n\
-            name,age\r\n\
-            Ophir,29\r\n\
-            Max,99\r\n\
-            --1234567890--\r\n",
-        )
-        .to_srv_request();
-    let resp = main_handler(req).await?;
+    let resp = response_from(multipart_request(
+        "/tests/uploads/upload_csv_test.sql",
+        "--1234567890\r\n\
+        Content-Disposition: form-data; name=\"people_file\"; filename=\"people.csv\"\r\n\
+        Content-Type: text/csv\r\n\
+        \r\n\
+        name,age\r\n\
+        Ophir,29\r\n\
+        Max,99\r\n\
+        --1234567890--\r\n",
+    ))
+    .await?;
 
     assert_eq!(resp.status(), StatusCode::OK);
-    let body = test::read_body(resp).await;
-    let body_str = String::from_utf8(body.to_vec()).unwrap();
+    let body_str = crate::common::read_body_string(resp).await;
     assert!(
         body_str.contains("Ophir is 29 years old"),
         "{body_str}\nexpected to contain: Ophir is 29 years old"