URL Encoding Explained: How to Safely Encode Query Parameters
Learn why URLs use percent encoding, which characters need encoding, and how to avoid broken query strings in web applications.
URLs have rules for how reserved and unsafe characters are represented. URL encoding, often called percent encoding, converts characters into a representation that can safely travel through a URL component. It is especially important when user input becomes a query parameter or path component.
Why URL encoding exists
Characters such as spaces, ampersands, question marks, and percent signs can have structural meaning inside a URL. Encoding distinguishes data from URL syntax. For example, an ampersand inside a parameter value should not accidentally be interpreted as the separator between two parameters.
Query strings and form data
When building a query string, encode each parameter value rather than manually concatenating raw user input. Most modern frameworks provide helpers for this purpose. Encoding the complete URL as one string when only a value should be encoded is a common source of bugs.
URL encoding is not validation
Encoding makes data safe for a particular URL context; it does not decide whether the data is acceptable. Applications still need validation, authorization, and output handling appropriate to the destination.
Common examples
A search phrase containing spaces can be encoded so it can safely appear as a query parameter. A value containing an ampersand should have that ampersand encoded when it is part of the value rather than a parameter separator.
Common mistakes
- Encoding a URL more than once.
- Encoding the whole URL instead of a component.
- Concatenating untrusted input directly into a URL.
- Confusing URL encoding with HTML escaping.
Frequently asked questions
Is URL encoding the same as HTML encoding?
No. They protect data for different contexts. URL encoding is used for URL components, while HTML escaping protects text inserted into HTML.
Why does a space become %20?
Percent encoding represents the byte value using hexadecimal notation. A space is commonly represented as %20 in URLs.
Should I encode path segments?
Yes, when a path segment contains characters that need encoding. Use your framework's URL helpers so the correct component is encoded exactly once.