URL Encoding and HTML Entities: What Are %20 and &?

URL encoding (percent-encoding) turns bytes that are "special or unsafe in a URL" into %XX; HTML entities turn characters that are "syntax in HTML" — < > & " — into forms like <. Both solve the same class of problem: your data collided with the syntax. This site offers a URL encoder/decoder and an HTML entity converter.

Which characters must be encoded in a URL

Character	Consequence if unencoded	Encoded
Space	Illegal	%20
&	Treated as parameter separator	%26
=	Treated as key-value separator	%3D
#	Treated as fragment start	%23
?	Treated as query-string start	%3F
/	Treated as path separator	%2F
Non-ASCII (e.g. 中)	Must be encoded	中 → %E4%B8%AD (three UTF-8 bytes, each prefixed with %)

The rule in one sentence: reserved characters inside a parameter value must be encoded; the & and = between parameters must not. This is the root cause of "an & in my value broke the query string" — the value wasn't encoded.

Encoding granularity

• encodeURIComponent: encodes nearly all reserved characters — use it for a single parameter value.
• encodeURI: leaves :/?#&= intact — use it for a whole URL.
• Mixing them up is a classic bug: running an entire URL through encodeURIComponent destroys every structural character.

HTML entities: the basics of injection defense

Character	Entity	Why escape it
<	&lt;	Otherwise parsed as the start of a tag
>	&gt;	Closes the pair
&	&amp;	Otherwise parsed as the start of an entity
"	&quot;	Quote-termination issues inside attribute values

If user input like <script>alert(1)</script> gets concatenated into a page unescaped, that's a textbook XSS. After escaping, the browser renders it as plain text. Any untrusted content written into HTML must be entity-escaped — this is a security baseline, not an optional optimization.

Last updated: 2026-09-08