How do I URl encode something in Node.js?

Question

I want to URL encode this:

SELECT name FROM user WHERE uid = me()

Do I have to download a module for this? I already have the request module.

Indeed, this is a slippy road and should be avoided at all costs. — Alfred, Jul 02 '11 at 00:23
Are you trying to put SQL statement in your url??? be careful of the [SQL Injection Attack](http://en.wikipedia.org/wiki/SQL_injection)! It's generally a bad idea to expose SQL to the users, it's really dangerous. — Leonmax, Aug 21 '12 at 16:03
@LightnessRacesinOrbit Doesn't Stack Exchange do this? If I understand this, it uses permissions at the DBMS to keep anything bad from happening. — Demi, Feb 12 '17 at 16:25
@Demi: No? How would that work. DBMS permissions are not sufficiently fine-grained, even if every single SO user got their own DB account. Tell me where on SO you see SQL queries passed directly? The one exception is data explorer, but that's all read-only views, and it's certainly not put in the URL. — Lightness Races in Orbit, Feb 12 '17 at 16:57
The guy could be building an SQL validation tool, nothing wrong with passing SQL commands in an example like that. Too much focus on not answering the question neither giving good advice (the most upvoted comment doesn't give good advice, only makes fun of the OP) — Rafael Eyng, May 14 '18 at 19:37

score 793 · Accepted Answer · edited Feb 21 '21 at 21:21

793

You can use JavaScript's encodeURIComponent:

encodeURIComponent('select * from table where i()')

giving

'select%20*%20from%20table%20where%20i()'

edited Feb 21 '21 at 21:21

Brian Burns

20,575
8
83
77

answered Jul 01 '11 at 23:12

Joe

80,724
18
127
145

100

To save visitors a search, yes... `decodeURIComponent` is how you _decode_ the encoded URI. You're welcome. – KyleFarris Apr 02 '19 at 19:41
3

It helped me query in Bengali language using NodeJS. Thank you! – Abid Nov 07 '21 at 06:23

nicolaskruchten · Answer 2 · 2013-07-07T18:51:55.023

149

The built-in module querystring is what you're looking for:

var querystring = require("querystring");
var result = querystring.stringify({query: "SELECT name FROM user WHERE uid = me()"});
console.log(result);
#prints 'query=SELECT%20name%20FROM%20user%20WHERE%20uid%20%3D%20me()'

edited Jul 07 '13 at 18:51

answered Jul 02 '11 at 23:56

nicolaskruchten

26,384
8
83
101

5

in this case we can only pass a map not a string, so if arg is a string then you will see nothing in result. So if you have strings to encode use encodeURIComponent(). – Ankit Patial Jul 31 '13 at 06:46
4

This is better for encoding JSON objects and POST-ing them. – Alex W Dec 20 '15 at 16:53
Not if the string contains ' or " characters – Jkarttunen Sep 16 '16 at 21:48

score 52 · Answer 3 · edited Feb 11 '16 at 21:02

52

Use the escape function of querystring. It generates a URL safe string.

var escaped_str = require('querystring').escape('Photo on 30-11-12 at 8.09 AM #2.jpg');
console.log(escaped_str);
// prints 'Photo%20on%2030-11-12%20at%208.09%20AM%20%232.jpg'

edited Feb 11 '16 at 21:02

Peter Mortensen

30,738
21
105
131

answered Feb 09 '14 at 21:57

Kamrul

7,175
3
31
31

1

This definitely appears to be the correct function; `querystring.stringify()` (in Nicolas' answer) seem to return an empty string now. – brandonscript May 13 '16 at 18:18
7

https://nodejs.org/api/querystring.html#querystring_querystring_escape_str says: "The `querystring.escape()` method is used by `querystring.stringify()` and is generally not expected to be used directly." – Simon Hänisch Aug 18 '17 at 01:24

Flimm · Answer 4 · 2015-09-14T14:17:21.413

Note that URI encoding is good for the query part, it's not good for the domain. The domain gets encoded using punycode. You need a library like URI.js to convert between a URI and IRI (Internationalized Resource Identifier).

This is correct if you plan on using the string later as a query string:

> encodeURIComponent("http://examplé.org/rosé?rosé=rosé")
'http%3A%2F%2Fexampl%C3%A9.org%2Fros%C3%A9%3Fros%C3%A9%3Dros%C3%A9'

If you don't want ASCII characters like /, : and ? to be escaped, use encodeURI instead:

> encodeURI("http://examplé.org/rosé?rosé=rosé")
'http://exampl%C3%A9.org/ros%C3%A9?ros%C3%A9=ros%C3%A9'

However, for other use-cases, you might need uri-js instead:

> var URI = require("uri-js");
undefined
> URI.serialize(URI.parse("http://examplé.org/rosé?rosé=rosé"))
'http://xn--exampl-gva.org/ros%C3%A9?ros%C3%A9=ros%C3%A9'

I don't understand why `xn--` is added in the second example. It will not work as an url or I missed something ? — TOPKAT, Jun 22 '21 at 11:26
Look on second "e" in `http://examplé.org` it is not ASCII character and should be presented as [punnycode](https://en.wikipedia.org/wiki/Punycode). — Jan aka uptech, Dec 11 '21 at 02:56

John Culviner · Answer 5 · 2022-10-20T19:08:17.970

18

encodeURIComponent(string) will do it:

encodeURIComponent("Robert'); DROP TABLE Students;--")
//>> "Robert')%3B%20DROP%20TABLE%20Students%3B--"

⚠️ Passing SQL around in a query string might not be a good plan though: see this one

edited Oct 20 '22 at 19:08

answered Jan 19 '18 at 17:34

John Culviner

22,235
6
55
51

3

We call him little Bobby Tables :-P – Jpnh Oct 14 '22 at 15:22

score 0 · Answer 6 · answered Jun 08 '22 at 08:38

encodeURI

The encodeURI() method is used to encode a complete URL. This method encodes special characters except ~!$&@#*()=:/,;?+

encodeURIComponent

To encode special characters in URI components, you should use the encodeURIComponent() method. This method is suitable for encoding URL components such as query string parameters and not the complete URL.

How do I URl encode something in Node.js?

6 Answers6

encodeURI

encodeURIComponent

Linked