URL query / repair handoff guide
Repair URL query plus signs, encoding, and duplicate keys
Review query boundaries without contacting the URL. Keep +, %2B, repeated keys, and #fragment separate.
A plus sign is not always a space
Form-style parsing may interpret a bare + as a space. If the value contains a literal plus, use %2B and confirm the receiving contract. Do not infer intent from a single URLSearchParams display.
q=a%2Bb → literal plus: a+b
q=a+b → form-style interpretation may be a b
q=a%252Bb → double-encoding boundary; do not decode blindly| Before | Repair policy | Outcome |
|---|---|---|
q=a%2Bb | Preserve the plus as a character. | preserve-plus |
q=a+b | Confirm whether the receiver expects a space or a plus. | confirm-space-or-plus |
q=a%252Bb | Confirm the intended encoding depth before changing it. | decode-depth-check |
Separate duplicate keys and fragments
Do not collapse tag=a&tag=b to the last value without a receiving contract. Preserve count and order. Everything after # is a fragment, not an HTTP query key/value pair.
| Boundary | What to check |
|---|---|
| duplicate-key | Keep tag=a&tag=b repeated and record its order. |
| fragment-boundary | Keep the query after ? separate from the fragment after #. |
| target URL | This guide never connects to the target and cannot determine redirects or server-side interpretation. |
Review cases
| case | outcome | check |
|---|---|---|
literal-plus | preserve-plus | Keep %2B as a literal plus. |
form-plus-space | confirm-space-or-plus | Confirm the receiver contract for a bare +. |
double-encoding | decode-depth-check | Do not decode %252B twice automatically. |
duplicate-key | preserve-order | Keep repeated key count and order. |
fragment-boundary | keep-fragment-separate | Do not merge the fragment into the query. |
target-or-unsupported | reject | Return target requests or ambiguous repair policies. |
Do not send input
This guide does not contact a target URL and does not inspect redirects, authentication, or server-side query interpretation. Use harmless examples; do not paste production URLs, tokens, cookies, or personal data.
Open the existing URL query builder (input and conversion remain local).