Which special characters are safe to use in url?

  • 2
    It would be far quicker and easier to ask which special characters are unsafe to use in a URL (as per Andreas Bonini's answer below). – Mark Hatton Jul 9 '10 at 13:50
  • 2
    Asking what is unsafe is as hard to answer: Any non-ascii character needs to be percent-encoded. – neo Jul 9 '10 at 14:14
  • 2
    @neo: no it doesn't :O – Thomas Bonini Jul 10 '10 at 1:55

The safe characters are a-z, A-Z, 0-9, and _ - (underscore and minus), that besides the reserved characters who are used for the parameters.

Other characters will give problems in some degree. example: if one parameter is an array ?param=array[content] ie will show an url whit the square brackets url encoded, which look ugly and impossible to dictate.

But the problem is not only it's ugly, lets say you have a jpg with a character beside the safer ones, many times the browser will be unable to download it getting a 404. This is a problem of older browsers and some mobile browsers.

How to test this?

  • put a bunch of images/js/css with the characters you want to test in the names in a public page with many visitors
  • Make the 404 page send you a email every time it get a hit

I have an inbox with 14000 emails proving my point.

  • 5
    well, instead of "safe characters" I would say "extremely safe characters" -- the spec allows more, but I agree with you that it's better to be conservative here. – Jeff Atwood Jul 11 '10 at 3:30
  • 2
    What's wrong with period? – BlueWhale Jun 7 '12 at 20:28

The following characters have special meaning in the path component of your URL (the path component is everything before the '?'):

  ";" | "/" | "?"

In addition to those, the following characters have special meaning in the query part of your URL (everything after '?'). Therefore, if they are after the '?' you need to escape them:

  ":" | "@" | "&" | "=" | "+" | "$" | ","

For a more in-depth explanation, see the RFC.

  • 3
    Of course, just for clarity, this answer is the opposite of the question. The question asks for which characters are safe, not those which are unsafe. Since it's hard to answer the original question robustly, the question should probably be edited to ask it the other way around and match this answer. – Mark Hatton Jul 9 '10 at 13:49

The answers here are good, but there is one more exception I think is worth mentioning - non-english characters. Referencing this SF question here, characters like ñ (as in Español) are perfectly legitimate, IF they have been encoded in your DNS correctly.

You have to use Punycode within your DNS to get them to resolve in modern browsers (the entry for español is xn--espaol-zwa) but these are now perfectly safe to use in domain names, as they're easy for non-english-speakers to type as well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.