EncodingAlso called: "percent encoding", "url escape"
URLs can only contain certain characters, so special characters must be encoded.
Why encoding is needed
- Spaces, slashes, and symbols have special meanings in URLs.
- Non-ASCII characters (é, ñ, 中) need encoding for compatibility.
- Prevents security issues from malformed URLs.
Common encodings
- Space: %20 or +
- Forward slash: %2F
- Question mark: %3F
- Ampersand: %26
- Hash: %23
Security implications
- Double encoding can bypass filters: %252F becomes %2F becomes /.
- URL encoding used in XSS, SQL injection, and path traversal attacks.