URL Encoding Is Not Optional (And Getting It Wrong Breaks Everything)

A URL can only contain a specific set of characters: letters, digits, and a handful of special characters (- _ . ~). Everything else must be percent-encoded. A space becomes %20. An ampersand becomes %26. A forward slash becomes %2F. This is not a suggestion. It is a requirement of RFC 3986. If you put a raw space in a URL, the behavior is undefined. Some browsers will encode it for you. Some will not. Some servers will interpret it one way, others differently. The only way to guarantee correct behavior is to encode properly. The encoding rules Unreserved characters (safe, no encoding needed): A-Z a-z 0-9 - _ . ~ Reserved characters (have special meaning in URLs): : / ? # [ ] @ ! $ & ' ( ) * + , ; = Everything else: must be percent-encoded as %XX where XX is the hex value of the byte. The key distinction: reserved characters have special meaning in URL structure. A ? separates the path from the query string. A & separates query parameters. A # marks the fragment. If your data contains