HTTP URL - allowed characters in parameter names

Question

Is there any formal restriction as to which characters are allowed in URL parameter names?

I\'ve been reading RFC3986 (\"Uniform Resource Identifier (URI): Generic S

Answer 1

There are no restrictions on escaped parameter names in the URI specs. There might be restrictions in the server-side software that you use, though. This is especially true if you use “homemade” scripts to interpret URIs.

Answer 2

You should also read RFC2396. It seems to be more informative than RFC3986.

Answer 3

Per RFC 2396, the parameter names and values can contain upper/lower case letters, decimal digits, and -_.!~*'() characters. Everything else needs to be escaped.

Answer 4

There are reserved characters for URLs, but as long as you escape (urlencode) then you should be fine.

Depending on the framework used, you may get exceptions if you try to submit suspicious values. ASP.NET has content filtering that will throw exceptions if you try to submit "unsafe" data, like scripts or HTML. That's a feature of the framework though rather than a limitation or rule enforced by the URL syntax.