Convert

URL Encoding — Percent-Encode and Decode Safely

Percent-encoding replaces characters that have a special meaning in a URL, or that cannot appear in one at all, with an escape sequence. The complication is that the rules differ by position: what must be escaped in a query parameter is not the same as what must be escaped in a path segment, and encoding a whole URL as though it were a single component produces something that looks encoded and does not work.

When it helps

Because the bugs are specific and repetitive. A parameter containing an ampersand silently splits into two parameters. A plus sign in a query string is interpreted as a space, so an email address or a signed token arrives subtly altered. A path containing a slash creates a route that does not exist. Each of those presents as the server behaving strangely rather than as an encoding problem, and decoding what actually arrived is the fastest way to see it.

Worth running automatically

Double-encoding is the failure worth guarding against systematically, because it survives casual inspection — a value encoded twice looks plausible and decodes to something with stray percent sequences in it. Anywhere URLs are constructed by concatenation across several layers, that is a real risk. Checking a monitored endpoint with awkward characters in its parameters, on a schedule, catches the day a framework upgrade changes its encoding behaviour.

What you get out of it

A definite answer to what the server received, rather than what you believe you sent. It resolves an entire category of bug that otherwise looks like unpredictable server behaviour.

Also in Convert