§ 5.1Component or full URL?
| Function | Leaves alone | Use for |
|---|---|---|
encodeURIComponent | Letters, digits and - _ . ! ~ * ' ( ) | One query value or path segment |
encodeURI | Also : / ? # [ ] @ & = + $ , | A whole URL you only need to make safe |
The classic bug: building ?q= + user input with encodeURI. An & in the input is left alone and splits your parameter in two. Encode each value with the component version.
§ 5.2Space: %20 or +?
RFC 3986 encodes a space as %20. HTML forms (application/x-www-form-urlencoded) use +. Servers usually accept both in query strings, but a + in a path stays a literal plus. Tick “Spaces as +” only when you are imitating a form submission.
§ 5.3Non-English characters
Characters outside ASCII are first turned into UTF-8 bytes, then each byte is percent-encoded: é becomes %C3%A9, ☕ becomes %E2%98%95.
§ 5.QQuestions
Why did decoding fail with “URI malformed”?
A % sign isn’t followed by two hex digits, or the bytes don’t form valid UTF-8 — for example a lone %E2. Encode literal % signs as %25.
Should I encode the whole URL?
Usually no. Encode each parameter value separately and join them with & and =.
§ 5.RReferences
Last reviewed 2026-10-14.