Encoding and security guides
URL encoding: spaces, plus signs and double encoding
Encode a query value once, preserve literal plus signs, and distinguish a URL component from a complete URL.
Encode a component
A query value containing an ampersand needs escaping so it is not mistaken for another parameter. Encode values, not the entire URL structure.
Use URLSearchParams with raw values to build queries. Passing already encoded values into it escapes the percent sign again.
new URLSearchParams({q:"a&b"}).toString()
→ q=a%26bPlus has a context
Form-style query parsing treats + as a space. A literal plus sign must be represented as %2B in that context.
Percent decoding alone does not necessarily apply form rules. Nav Tools offers separate component decoding and query inspection; check which one matches your protocol.
q=a+b → "a b" in form query parsing
q=a%2Bb → "a+b"Recognize double encoding
The percent sign is encoded as %25, so %252F decodes once to %2F and twice to /. Those values can mean different things in a route.
Do not repeatedly decode until the output looks readable. Define the number of encoding layers at the boundary to avoid changing path separators unexpectedly.
Verify a round trip
Build a query with spaces, a literal plus, Unicode and an ampersand. Parse it once and compare the resulting values with the originals.
Keep repeated keys if the API permits them. Converting a query to an ordinary object can discard duplicates even when the URL is correctly encoded.