Calcul 100% dans le Navigateur • Zéro Journal Serveur • Exécution Instantanée
Curious TechieBoîte à Outils
ENCODING5 min de lecture•Français EditionExécution 100% Côté Client

Qu’est-ce que l’URL Encoding (Percent-Encoding) ?

Norme RFC 3986, caractères réservés, transposition des octets UTF-8 et assainissement des requêtes.

CT
Curious-Techie Engineering TeamAuteur Vérifié

Web Protocols & Security Architecture Research

Publié :
•
Mis à jour :
•5 min de lecture
Spécification Faisant Foi :RFC 9110(IETF)
Revu par Curious-Techie Architecture Peer Review Group
Question Principale • Réponse Technique Immédiate

Qu’est-ce que l’URL Encoding (Percent-Encoding) ?

TL;DR — Points Clés d’Ingénierie

  • L’encodage pourcent convertit les caractères en séquences hexadécimales %HH selon la RFC 3986.
  • Les séparateurs comme ?, & et = doivent être protégés dans les valeurs d’URL.
  • encodeURIComponent() cible les valeurs précises, encodeURI() préserve les chemins d’accès.
  • L’espace s’exprime par %20 ou + selon le contexte applicatif.
// FONDAMENTAUX

Concepts Clés et Architecture

Unreserved Characters

Safe

Characters permitted in any URI component without encoding: `ALPHA`, `DIGIT`, `-`, `_`, `.`, `~` (RFC 3986 Section 2.3).

Reserved Characters

Delimiters

Characters with reserved syntactic meaning (e.g. `?` initiates query, `#` initiates fragment, `/` separates path segments).

Percent Triplet (%XX)

Syntax

The 3-character sequence consisting of "%" followed by two hexadecimal digits (0-9, A-F) mapping to a specific byte.

application/x-www-form-urlencoded

Forms

Legacy HTML form encoding MIME type where spaces become `+` instead of `%20`, often handled via URLSearchParams.

UTF-8 Octet Multi-byte Encoding

Unicode

Non-ASCII characters (e.g. accented letters, emojis) are converted into multi-byte UTF-8 sequences, producing multiple percent triplets (e.g. "🚀" -> `%F0%9F%9A%80`).

Question Secondaire • Flux d’Exécution

Comment fonctionne Qu’est-ce que l’URL Encoding (Percent-Encoding) ? ?

Réponse Directe:

When a web application parses or constructs a URI, each component (scheme, authority, path, query, fragment) must respect delimiter boundaries. When encoding, the processor converts each character into its UTF-8 byte stream, checks whether each byte is in the unreserved set, and replaces any disallowed byte with `%` plus its uppercase 2-digit hexadecimal representation.

1

String to UTF-8 Byte Stream

Convert characters to raw byte octets according to UTF-8 encoding.

"€" (Euro symbol) -> [0xE2, 0x82, 0xAC]
2

Character Classification

Determine if character is unreserved, reserved-as-data, or reserved-as-delimiter.

"=" used as query value parameter must be encoded; used as key/value delimiter is preserved.
3

Hexadecimal Hex Transformation

Convert each prohibited byte into two hexadecimal characters.

0xE2 -> "E2", 0x82 -> "82", 0xAC -> "AC"
4

Percent Triplet Concatenation

Prefix each byte with "%" to generate the final escaped sequence.

"€" -> "%E2%82%AC"
5

URI Construction

Integrate safe percent triplets into target URI path or query string parameter.

https://api.curious-techie.com/search?currency=%E2%82%AC
Exemples Techniques • Implémentation

Comment implémenter Qu’est-ce que l’URL Encoding (Percent-Encoding) ? en pratique ?

JavaScript: Safe Query Parameter Building using URL and URLSearchParams

typescript
// Constructing robust URLs using modern WHATWG URL API
const baseUrl = "https://api.curious-techie.com/v1/search";
const url = new URL(baseUrl);

// Set query params safely (handles percent encoding automatically!)
url.searchParams.set("q", "cryptographic hashing & signatures");
url.searchParams.set("redirect", "https://app.curious-techie.com/dashboard?view=full");
url.searchParams.set("symbol", "€");

console.log(url.toString());
// Output: https://api.curious-techie.com/v1/search?q=cryptographic+hashing+%26+signatures&redirect=https%3A%2F%2Fapp.curious-techie.com%2Fdashboard%3Fview%3Dfull&symbol=%E2%82%AC

// Reading and decoding params
const params = new URLSearchParams(url.search);
console.log(params.get("q")); // "cryptographic hashing & signatures" (auto decoded)

Détails d’Ingénierie: Using the WHATWG URL API automatically applies correct percent-encoding to keys and values, avoiding manual concatenation errors.

The Critical Difference: encodeURI vs encodeURIComponent

javascript
const rawParam = "user/profile?role=admin&id=10";

// encodeURI leaves protocol and path delimiters intact:
console.log(encodeURI(rawParam));
// "user/profile?role=admin&id=10" (BROKEN if passed as a query value!)

// encodeURIComponent encodes ALL reserved syntax delimiters:
console.log(encodeURIComponent(rawParam));
// "user%2Fprofile%3Frole%3Dadmin%26id%3D10" (CORRECT for query values)

// Correct usage pattern:
const targetPage = "https://curious-techie.com/auth";
const callback = "https://curious-techie.com/welcome?lang=en";
const fullUrl = `${targetPage}?next=${encodeURIComponent(callback)}`;

Détails d’Ingénierie: Never pass query parameter values through encodeURI; always use encodeURIComponent to ensure ?, &, and = do not corrupt the outer query structure.

Architecture de Production • Contexte Réel

Où et pourquoi utilise-t-on Qu’est-ce que l’URL Encoding (Percent-Encoding) ? en production ?

OAuth 2.0 & OpenID Connect Authorization Flows

Passing the client callback `redirect_uri` and encrypted `state` tokens in the authorization URL.

Authorization servers require the `redirect_uri` to be strictly percent-encoded to prevent parameter injection attacks.

Search Engine Deep Links and Unicode Tags

Generating clean canonical URLs for technical tags containing symbols like C++, C#, or international language characters.

Paths like `/tags/c%2B%2B` preserve the plus symbol without being stripped or treated as whitespace by web servers.

Pièges et Anti-patterns • Idées Reçues

Quelles sont les erreurs courantes concernant Qu’est-ce que l’URL Encoding (Percent-Encoding) ? ?

Anti-Pattern: Using `encodeURI()` on individual query parameter values

Impact: Reserved delimiters like `&` and `=` in the value remain unencoded, corrupting the query string into unexpected split parameters.

Correction Recommandée: Always use `encodeURIComponent()` or `URLSearchParams` for parameter values.

Anti-Pattern: Double Encoding URLs (%2520 bug)

Impact: Encoding an already-encoded URL transforms `%20` into `%2520`, resulting in literal `%20` text appearing on the screen instead of spaces.

Correction Recommandée: Only encode raw, unencoded input values once; never pass an assembled URL back through encoding functions.

Anti-Pattern: Confusing `+` and `%20` across HTTP specs

Impact: Using `+` inside URI path segments represents a literal plus character, but in `application/x-www-form-urlencoded` query strings it represents a space.

Correction Recommandée: Follow RFC 3986 strictly: use `%20` for paths; rely on standard URL parsers for form-encoded queries.

Modélisation des Menaces • Vecteurs d’Attaque

Quels sont les risques et implications sécuritaires de Qu’est-ce que l’URL Encoding (Percent-Encoding) ? ?

Path Traversal via Nested Percent-Encoding

CWE-22 Improper Limitation of a Pathname to a Restricted Directory

Vulnérabilité: WAF or proxy decodes `%2e%2e%2f` once to `../`, or decodes `%252e%252e%252f` to bypass path restriction filters.

Stratégie de Mitigation: Normalize and validate paths AFTER all URL decoding has completed; verify paths resolve within root directory boundaries.

Server-Side Request Forgery (SSRF) via Encoded Delimiters

OWASP Top 10 A10:2021 Server-Side Request Forgery (SSRF)

Vulnérabilité: Attacker passes percent-encoded credentials or newline injections (`%0d%0a`) into backend HTTP client URLs.

Stratégie de Mitigation: Use strict URL parser objects rather than string interpolation; validate hostnames against an IP allowlist.
Diagnostics • Résolution de Cause Racine

Comment diagnostiquer et corriger les erreurs avec Qu’est-ce que l’URL Encoding (Percent-Encoding) ? ?

Symptômes et Signes Cliniques: Plus signs "+" in query strings are unexpectedly replaced with empty spaces on the server

Analyse Technique de la Cause Racine:
  • Server parser defaults to application/x-www-form-urlencoded specification where "+" signifies space
Correctif Vérifié en Production: Percent-encode literal plus signs as `%2B` in query string parameter values.

Symptômes et Signes Cliniques: URIError: URI malformed during `decodeURIComponent()`

Analyse Technique de la Cause Racine:
  • Input string contains an incomplete percent sequence (e.g. "item%2" or "%FF" invalid UTF-8 sequence)
Correctif Vérifié en Production: Wrap decoding in a `try...catch` block or validate percent triplets match `/%[0-9a-fA-F]{2}/g`.
Base de Connaissances • Réponses Directes

Questions Fréquentes sur Qu’est-ce que l’URL Encoding (Percent-Encoding) ?

Q:What is the difference between URL encoding and percent-encoding?

Réponse Directe:There is no difference; percent-encoding is the formal technical term defined in RFC 3986, while "URL encoding" is the colloquial industry name for the same mechanism.

Both terms refer to replacing non-ASCII or reserved characters with a percent symbol "%" followed by two hexadecimal digits representing the byte in UTF-8.

Q:Should a space be encoded as "+" or "%20"?

Réponse Directe:In standard RFC 3986 URI paths and headers, space must always be encoded as "%20". In query strings submitted via HTML forms (application/x-www-form-urlencoded), "+" is permitted as an alias for space.

Modern REST APIs and WHATWG specifications prefer "%20" consistently across both paths and queries to prevent ambiguity.

Section 12 • Utilitaires Interactifs

Outils Développeur Associés

Exécution 100% Côté Client

Companion Interactive Tool100% Client-Side Execution

Test & Verify with URL Encoder / Decoder

Encode and decode URL parameters and query strings (RFC 3986).

Companion Interactive Tool100% Client-Side Execution

Test & Verify with Base64 Encoder / Decoder

Encode and decode Base64 strings and UTF-8 text client-side.

Companion Interactive Tool100% Client-Side Execution

Test & Verify with Hex ↔ Text Converter

Convert plain text to hexadecimal bytes and hex strings back to text.

Companion Interactive Tool100% Client-Side Execution

Test & Verify with HTTP Header Analyzer

Analyze raw or live HTTP response headers for caching and architecture.

Glossaire

Percent-Encoding
A mechanism to encode arbitrary data in a URI using only US-ASCII characters.
Reserved Characters
Characters that have special structural meaning within a URI, such as "/", "?", "&", and "#".
Unreserved Characters
Characters that are allowed in any URI without being percent-encoded (A-Z, a-z, 0-9, "-", "_", ".", "~").