URL Encode and Decode
Apply and remove percent encoding in URLs, telling a whole address apart from a single parameter value.
Encoding/, ? e &:
serve per un valore da inserire in un parametro. Togli la spunta per codificare un URL intero.
Why URLs need encoding
A web address may only contain a restricted set of characters. Everything else
— spaces, accents, ideographs, emoji — must be written using percent encoding:
each byte becomes a percent sign followed by two hexadecimal digits. A space
becomes %20; an accented letter becomes two groups, because in UTF-8
it takes two bytes.
Whole address or single value
This is the distinction that causes most mistakes. Some characters —
/, ?, &, = — carry
meaning in a URL: they separate the path, open the query, divide parameters.
When encoding a whole address they must be left alone, or the address
breaks. When encoding a value to place inside a parameter they must be
encoded, or that value gets read as structure.
The classic mistake
A URL passed as a parameter of another URL without its query being encoded:
everything after the first & is read as a parameter of the outer
address, and the value arrives truncated. It is why return links after a sign-in
sometimes lose half of their path.
Encoding is not protection
Percent encoding exists to carry characters, not to hide them or make a value safe. Data placed into a page still needs escaping: encoding it for a URL does not make it harmless in HTML.
Frequently asked questions
When you are encoding a complete address. With it ticked, /, ? and & are encoded too, and those are needed as-is in a whole address.
The plus sign belongs to HTML form encoding, not to URLs. In the path of an address a space is always %20; in the query both forms occur, and servers usually accept either.
Usually because the text contains a percent sign not followed by two valid hexadecimal digits — often because it has already been decoded once.