What is Percent-Encoding (URL Encoding)?
Percent-encoding, defined in IETF RFC 3986, is the standard mechanism for encoding arbitrary characters within a Uniform Resource Identifier (URI). Characters like spaces, question marks (?), ampersands (&), slashes (/), and equals signs (=) have structural syntactical roles within a URL.
When passing dynamic user data (e.g. search queries, email addresses, redirect destination URLs) as query string parameters, these special characters must be converted into their percent-encoded equivalents. Failure to properly percent-encode parameters leads to severed query strings, server 404/500 routing errors, and HTTP parameter pollution vulnerabilities.
ASCII Character Percent-Encoding Reference Table
| Character | Hex Value | Percent-Encoded | Syntactic Role in URLs |
|---|---|---|---|
| Space | 0x20 |
%20 |
Disallowed in raw URLs; separates tokens. |
? |
0x3F |
%3F |
Delimits the start of the query string. |
& |
0x26 |
%26 |
Separates individual key-value query parameters. |
= |
0x3D |
%3D |
Assigns a value to a parameter key. |
/ |
0x2F |
%2F |
Delimits path hierarchy segments. |
# |
0x23 |
%23 |
Delimits client-side fragment identifiers (hash). |
Programmatic URL Encoding in Code
JavaScript (Component Level)
const searchQuery = "React & Node.js Guide?";
const safeUrl = `https://api.example.com/search?q=${encodeURIComponent(searchQuery)}`;
console.log(safeUrl);
// Output: https://api.example.com/search?q=React%20%26%20Node.js%20Guide%3FPython 3 (urllib.parse)
import urllib.parse
param = "hello world & foo=bar"
encoded = urllib.parse.quote(param, safe='')
print("Encoded:", encoded)
decoded = urllib.parse.unquote(encoded)
print("Decoded:", decoded)