Currently all the links on my website look like

<a href="&#x2F">Home</a>
<a href="&#x2F;user&#x2F;settings">Settings</a>
<a href="&#x2F;user&#x2F;logout&#x3F;redirect&#x3D;&#x2F;products&#x2F;207292">Log out</a>

So all href atrributes are HEX-encoded with the corresponding entities (&#xHH) to prevent any XSS issues.

Google doesn't show a warning for these links, but some online SEO tools consider these links to be broken since they treat them as & (ampersand) followed by # (hash) and drop everything after #.

So is it safe for SEO using this kind of HTML attribute encoding or I should heed the advise of the SEO tools?

  • 1
    Cross Site Scripting seldom really has anything to do with your links. Some times existing links are used, but changing the link does not stop XSS. You are better off blocking using .htaccess. – closetnoc Apr 13 '15 at 18:04
  • 1
    Following on from @closetnoc's comment... I'm curious, why do you think encoding the URLs is going to "prevent any XSS issues"? The SEO tools themselves could be "broken", or just not really thorough enough. – MrWhite Apr 13 '15 at 23:31
  • 1
    Encoding a smaller set of characters: &<>'" should be enough to stop XSS. No need to encode /. Good browsers will have no problem with your links. That should include search engine bots. Hopefully Yahoo has fixed their bugs in this area, but they didn't properly recognize my title with an &amp; in the HTML code. – Stephen Ostermiller Apr 14 '15 at 1:18
  • 1
    @StephenOstermiller And it's only necessary to do XSS-related escaping for URLs originating from user-generated content. Doing it for URLs in the navigation bar is pointless (but remember, the user's name is user-generated content). – Michael Hampton Apr 14 '15 at 1:23
  • To clarify, I don't do that purposely, a PHP framework I use (ZF2) encodes URLs by default. – Alexey Kosov Apr 14 '15 at 6:00

These URLs are valid only when present in an HTML document, and "some online SEO tools" are sort of incorrect to report this as a problem.

What happens here is that you have used numeric HTML entities to represent various characters, but the URL format does not treat these as encoded characters that should be decoded to get the URL that will actually be used. The only permitted encoding in a URL is percent encoding.

The parser used by this online tool, however, does not take into account that HTML parsing engines are required to decode HTML entities early in document parsing, before the URL is actually used.

The ABNF grammar given in RFC 3986 makes clear that neither & nor # are valid at this point in the URL. And, in the most recent revision of the URL specification work in progress, all of the URLs you gave as examples are supposed to return a parse error. This means the URL is not valid generally and should never be given out as a bare link or in any non-HTML context. It only becomes valid after the HTML parser is done with it.

If you use URL percent encoding as, e.g. %2Fuser%2Fsettings then this will be parsed correctly by everyone, and these URLs are safe to use anywhere. But note that the ? which delineates the query string is not allowed to be percent encoded. Neither is the scheme (e.g. http or https) and the :// which follow it, allowed to be percent encoded.

So, there's no real SEO impact here.

But, there's also no real reason to do this for everything. For cross-site scripting, for instance, you aren't letting users construct their own URLs. If you were, then you need to do some escaping. And as it's trivially parsed it doesn't really obfuscate anything.

| improve this answer | |
  • The previous version of this answer turns out to have been wrong. I apologize for any confusion. – Michael Hampton Apr 14 '15 at 1:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.