278

I am trying to send a GET message that contains strings with ampersands and can't figure how to escape the ampersand in the URL.

Example:

http://www.example.com?candy_name=M&M
result => candy_name = M

I also tried:

http://www.example.com?candy_name=M\&M
result => candy_name = M\\

I am using URLs manually, so I just need the correct characters.

I can't use any libraries. How can it be done?

Dharman
  • 30,962
  • 25
  • 85
  • 135
tomermes
  • 22,950
  • 16
  • 43
  • 67

8 Answers8

471

They need to be percent-encoded:

> encodeURIComponent('&')
"%26"

So in your case, the URL would look like:

http://www.example.com?candy_name=M%26M
Benjamin Loison
  • 3,782
  • 4
  • 16
  • 33
Blender
  • 289,723
  • 53
  • 439
  • 496
  • 9
    :- %26 is not working for me. Is there any other solution.? – Sanjiv Aug 23 '16 at 06:12
  • 4
    When i replace & to %26, its still showing the same error-- `A potentially dangerous Request.Path value was detected from the client (&).` – Sanjiv Aug 23 '16 at 06:14
  • 8
    @Sanjiv: That's a problem with your code, not percent encoding. Ask a question. – Blender Aug 23 '16 at 06:19
  • 3
    @Sanjiv make sure you replace "&" with "%26" first. See code::: NSString *message = @"Hello Jack & Jill"; message = [message stringByReplacingOccurrencesOfString:@"&" withString:@"%26"]; message = [message stringByAppendingString:@" "]; message = [message stringByAddingPercentEscapesUsingEncoding: NSUTF8StringEncoding]; – Nirav Mar 31 '17 at 13:35
  • Thank you for this! Saved me a ton of headache setting a database connection URI variable – AB1 Mar 15 '22 at 03:42
46

This does not only apply to the ampersand in URLs, but to all reserved characters. Some of which include:

# $ & + ,  / : ; = ? @ [ ]

The idea is the same as encoding an & in an HTML document, but the context has changed to be within the URI, in addition to being within the HTML document. So, the percent-encoding prevents issues with parsing inside of both contexts.

The place where this comes in handy a lot is when you need to put a URL inside of another URL. For example, if you want to post a status on Twitter:

http://www.twitter.com/intent/tweet?status=What%27s%20up%2C%20StackOverflow%3F(http%3A%2F%2Fwww.stackoverflow.com)

There's lots of reserved characters in my Tweet, namely ?'():/, so I encoded the whole value of the status URL parameter. This also is helpful when using mailto: links that have a message body or subject, because you need to encode the body and subject parameters to keep line breaks, ampersands, etc. intact.

When a character from the reserved set (a "reserved character") has special meaning (a "reserved purpose") in a certain context, and a URI scheme says that it is necessary to use that character for some other purpose, then the character must be percent-encoded. Percent-encoding a reserved character involves converting the character to its corresponding byte value in ASCII and then representing that value as a pair of hexadecimal digits. The digits, preceded by a percent sign ("%") which is used as an escape character, are then used in the URI in place of the reserved character. (For a non-ASCII character, it is typically converted to its byte sequence in UTF-8, and then each byte value is represented as above.) The reserved character "/", for example, if used in the "path" component of a URI, has the special meaning of being a delimiter between path segments. If, according to a given URI scheme, "/" needs to be in a path segment, then the three characters "%2F" or "%2f" must be used in the segment instead of a raw "/".

http://en.wikipedia.org/wiki/Percent-encoding#Percent-encoding_reserved_characters

Benjamin Loison
  • 3,782
  • 4
  • 16
  • 33
Alex W
  • 37,233
  • 13
  • 109
  • 109
9

I would like to add a minor comment to Blender's solution.

You can do the following:

var link = 'http://example.com?candy_name=' + encodeURIComponent('M&M');

That outputs:

http://example.com?candy_name=M%26M

The great thing about this it does not only work for &, but for any especial character.

For instance:

var link = 'http://example.com?candy_name=' + encodeURIComponent('M&M?><')

Outputs:

"http://example.com?candy_name=M%26M%3F%3E%3C"
Benjamin Loison
  • 3,782
  • 4
  • 16
  • 33
Antonio
  • 409
  • 5
  • 12
8

Try using http://www.example.org?candy_name=M%26M.

See also this reference and some more information on Wikipedia.

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
gkalpak
  • 47,844
  • 8
  • 105
  • 118
6

You can use the % character to 'escape' characters that aren't allowed in URLs. See RFC 1738.

A table of ASCII values is given on the Wikipedia page.

You can see & is 26 in hexadecimal - so you need M%26M.

Peter Hull
  • 6,683
  • 4
  • 39
  • 48
2

This may help if someone want it in PHP

$variable = "candy_name=M&M";
$variable = str_replace("&", "%26", $variable);
Benjamin Loison
  • 3,782
  • 4
  • 16
  • 33
Mohamed Ramadan
  • 65
  • 4
1

If you can't use any libraries to encode the value, http://www.urlencoder.org/ or http://www.urlencode-urldecode.com/ or ...

Just enter your value "M&M", not the full URL ;-)

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
Oliver
  • 224
  • 1
  • 7
0

You can rather pass your arguments using this encodeURIComponent function so you don't have to worry about passing any special characters.

data: "param1=getAccNos&param2="+encodeURIComponent('Dolce & Gabbana') OR
var someValue = 'Dolce & Gabbana';
data : "param1=getAccNos&param2="+encodeURIComponent(someValue)

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/encodeURIComponent

deilkalb
  • 445
  • 1
  • 4
  • 10