URL encoding without breaking URL structure
Percent-encoding represents bytes as %HH. The important decision is not just what to encode, but which URL component you are encoding.
Structure and data are different
A URL can contain a scheme, host, port, path, query and fragment. Characters such as :,
/, ?, &, = and # help separate those parts.
If an entire URL is encoded as though it were one data value, its structural separators become text and
the browser can no longer interpret it normally. Encode a path segment or query value before inserting it
into a URL; do not blindly encode the completed address.
How percent-encoding works
Unreserved ASCII letters, digits, hyphen, period, underscore and tilde normally remain unchanged. Other
characters are converted to bytes—usually UTF-8—and each byte is written as a percent sign followed by
two hexadecimal digits. A space can appear as %20. In form-style query encoding it may appear
as +, which is why decoding rules must match the producer.
Non-ASCII text uses more than one escape. The Turkish letter “ş”, for example, is represented by two UTF-8
bytes and therefore two %HH sequences. Decoding the percent escapes without decoding UTF-8
afterward produces mojibake rather than the original character.
Query parameters
Suppose a search value is red & blue. Placing it directly after ?q= makes the
ampersand look like a new parameter separator. Encode the value so the server receives one value. Use a
URL or query builder in application code because it handles separators, repeated keys and character encoding
more reliably than string concatenation.
Path segments
A slash inside a user-provided filename or identifier can create another path level. Encode the segment, not the slashes that intentionally divide the route. Be cautious with servers that decode paths more than once: values such as encoded dots or slashes can interact with routing and path traversal defenses.
Fragments and nested URLs
A fragment begins after # and is normally handled by the browser rather than sent in the HTTP
request. If one URL is carried as a query parameter inside another, encode the inner URL as the outer
parameter value. This preserves its own ?, & and # characters as data.
Common mistakes
- Double encoding:
%20becomes%2520because the percent sign was encoded again. - Encoding too late: an unescaped ampersand has already split a query value.
- Using the wrong decoder: a plus sign is treated as space even though it was meant literally.
- Assuming encoding is validation: a syntactically safe value may still violate application rules.
Safe construction checklist
- Parse or construct URLs with a platform URL API where possible.
- Encode individual user-controlled components exactly once.
- Validate the decoded value at the destination; do not use encoding as a security filter.
- Test spaces, plus signs, ampersands, slashes, percent signs and non-ASCII characters.