为什么我应该对通过GET传递的URL进行网址编码

Question

Suppose I do

http://site.com/something?url=http://lol.com/lol

are there any advantages (eg security etc) of doing

'http://site.com/something?url=' . urlencode('http://lol.com/lol');

instead of just passing in an unencoded version of the url in? Why should I urlencode something passed via GET instead of just passing in an uncoded version (though of course if the url param has & or ? or = in it then I should definitely encode it...but suppose they don't, why should I encode them)

Answer 1

There are characters which have special meaning in URLs. Those characters will have special meaning in the outer URL (instead of the inner URL where they belong) if you pass them without encoding.

For example, if you want to pass

http://example.com/foo?1=2&3=4

And you don't encode it, then you will get:

http://example.com/?url=http://example.com/foo?1=2&3=4

with

url is http://example.com/foo?1=2
3 is 4

suppose they don't, why should I encode them

Because then you have to look at every URL you pass to decide if it needs encoding or not.

Always encoding is much simpler and less error prone then deciding on a case by case basis.

Answer 2

只要我知道第二个示例就很好，如果您有可能在url中使用unicode字符。