URL Encode / Decode

RFC 3986 divides URL characters into three buckets:

• Unreserved — letters (A-Z, a-z), digits (0-9), and - . _ ~. Never encoded.
• Reserved — have special meaning in URLs: : / ? # [ ] @ ! $ & ' ( ) * + , ; =. Encoded when they appear in the "wrong" place (e.g. a ? inside a query value).
• Everything else — spaces, Unicode, control characters. Always encoded.

Common escapes:

JavaScript has two URL-encoding functions with a crucial difference:

// encodeURI — leaves reserved chars alone (encodes for "a whole URL")
encodeURI("https://example.com/path with spaces?a=1&b=2")
// "https://example.com/path%20with%20spaces?a=1&b=2"
//        ↑ colons, slashes, ?, & all preserved

// encodeURIComponent — encodes reserved chars (encodes for "a single query value")
encodeURIComponent("a=1&b=2")
// "a%3D1%26b%3D2"
//        ↑ = and & encoded

Rule: use encodeURIComponent for each query parameter value, never encodeURI on them. Using encodeURI on a query value means = and & inside the value will break the URL structure.

// ✗ WRONG — breaks if comment contains = or &
url += "?comment=" + encodeURI(userComment);

// ✓ RIGHT
url += "?comment=" + encodeURIComponent(userComment);

Python equivalents: urllib.parse.quote() (like encodeURI, leaves /) vs urllib.parse.quote_plus() (like encodeURIComponent, replaces space with +).