URL encode a query parameter

Why query values get cut off

A query string uses ampersands to separate parameters and equals signs to connect names with values. If those characters appear inside the value itself, the browser or server may read the value as several different parameters unless the value is percent-encoded.

Example

redirect=https://example.com/done?status=ok&name=dev tools

redirect=https%3A%2F%2Fexample.com%2Fdone%3Fstatus%3Dok%26name%3Ddev%20tools

How to encode the value

1. Identify the parameter value, not the entire query string, before encoding.
2. Encode spaces as %20 and encode reserved characters such as ampersand, equals sign, question mark, and slash when they are part of the value.
3. Paste the encoded value after the parameter name.
4. Decode once to check that the value still reads correctly before sharing the URL.

Nested URLs need extra care

Callback, redirect, and return URLs are often complete URLs placed inside one query parameter. In that case, encoding the nested URL as the value is correct because its question marks and ampersands belong to the nested value, not the outer query string.

When debugging, decode the parameter value once and compare it with the original nested URL. If the decoded value still contains percent sequences, it may have been encoded more than once by another system.

Common mistakes

• Encoding the parameter name and separator along with the value
• Leaving an ampersand inside a value and accidentally creating a second parameter
• Double-encoding a value that already contains percent sequences
• Encoding a full URL when only one query value needed encoding

Related problems