Can a percent encoded slash be used to designate a literal slash in a file name on a web server?

Question

As I understand, characters in URL are either reserved (have a special meaning) or unreserved (do not have a special meaning).

Am I correct that percent-encoding is used in URL if one needs to send literal value of character to web server? For example, if I have a document named document/_with_forward_slash_in_its_name.html in web server root folder, then I should use the URL www.example.com/document%2f_with_forward_slash_in_its_name.html because otherwise web server would think that I'm looking for a file named _with_forward_slash_in_its_name.html from directory document?

Is there a difference if this / character is in query string, e.g http://www.example.com/get-page.php?home=document/_with_forward_slash_in_its_name.html?

Why there are multiple ways to decode reserved characters, e.g / can be %2F, %2f or %c0%af?

Answer 1

While there are a number of file systems such as MacOS's HFS that accept a slash within a filename (/ or \), these are generally considered to be reserved characters on many popular file systems, and importantly on the file systems typically used commercially as web servers (Windows/Linux). Therefore while you will need to observe the file system limitations of your intended deployment server, for best practice and in the interests of compatibility, you should also observe the file system limitations which are common or typical in order to ensure smooth transition should your hosting requirements and environment change in future.

The principle of URL-encoding (what you referred to as percent-encoding) is the method of using the correct syntax in the URL so that special characters can be sent in the URL without breaking the validity. A better example would have been for filenames that have a space character within them, for example my file.html would become my+file.html since a valid URL cannot have a space character.

There are not multiple ways URL-encode or decode reserved characters. %2F and %2f are the same thing, case insensitive, because the 2F represents a hexadecimal value, the decimal equivalent of which would be 47, and if you look at the ASCII table you'll see that character 47 is the forward slash (/).

%c0%af would be in decimal character 192 followed by character 175, both of which are extended ASCII characters and could vary in appearance depending on the font chosen. The HTML equivalent would be À¯ and might be displayed as À¯, definately not the same as a forward slash as you had thought.