URL encoding the space character: + or %20?

Question

When is a space in a URL encoded to +, and when is it encoded to %20?

Answer 1

From Wikipedia (emphasis and link added):

When data that has been entered into HTML forms is submitted, the form field names and values are encoded and sent to the server in an HTTP request message using method GET or POST, or, historically, via email. The encoding used by default is based on a very early version of the general URI percent-encoding rules, with a number of modifications such as newline normalization and replacing spaces with "+" instead of "%20". The MIME type of data encoded this way is application/x-www-form-urlencoded, and it is currently defined (still in a very outdated manner) in the HTML and XForms specifications.

So, the real percent encoding uses %20 while form data in URLs is in a modified form that uses +. So you're most likely to only see + in URLs in the query string after an ?.

Answer 2

This confusion is because URLs are still 'broken' to this day.

From a blog post:

Take "http://www.google.com" for instance. This is a URL. A URL is a Uniform Resource Locator and is really a pointer to a web page (in most cases). URLs actually have a very well-defined structure since the first specification in 1994.

We can extract detailed information about the "http://www.google.com" URL:

+---------------+-------------------+ |      Part     |      Data         | +---------------+-------------------+ |  Scheme       | http              | |  Host         | www.google.com    | +---------------+-------------------+ 

If we look at a more complex URL such as:

"https://bob:[email protected]:8080/file;p=1?q=2#third"

we can extract the following information:

+-------------------+---------------------+ |        Part       |       Data          | +-------------------+---------------------+ |  Scheme           | https               | |  User             | bob                 | |  Password         | bobby               | |  Host             | www.lunatech.com    | |  Port             | 8080                | |  Path             | /file;p=1           | |  Path parameter   | p=1                 | |  Query            | q=2                 | |  Fragment         | third               | +-------------------+---------------------+  https://bob:[email protected]:8080/file;p=1?q=2#third \___/   \_/ \___/ \______________/ \__/\_______/ \_/ \___/   |      |    |          |          |      | \_/  |    | Scheme User Password    Host       Port  Path |   | Fragment         \_____________________________/       | Query                        |               Path parameter                    Authority 

The reserved characters are different for each part.

For HTTP URLs, a space in a path fragment part has to be encoded to "%20" (not, absolutely not "+"), while the "+" character in the path fragment part can be left unencoded.

Now in the query part, spaces may be encoded to either "+" (for backwards compatibility: do not try to search for it in the URI standard) or "%20" while the "+" character (as a result of this ambiguity) has to be escaped to "%2B".

This means that the "blue+light blue" string has to be encoded differently in the path and query parts:

"http://example.com/blue+light%20blue?blue%2Blight+blue".

From there you can deduce that encoding a fully constructed URL is impossible without a syntactical awareness of the URL structure.

This boils down to:

You should have %20 before the ? and + after.

Source