URL Parser

The anatomy

A URL splits into scheme, an optional userinfo section, host, optional port, path, query and fragment. Each has its own escaping rules, and treating a URL as a single string rather than a structured value is where most URL bugs begin.

The fragment never leaves the browser

Everything after the hash is client-side only and is not sent to the server. Putting a token or any parameter in a fragment and expecting server-side code to read it produces a bug that is confusing precisely because the value is plainly visible in the address bar. Conversely, this is why fragments are sometimes used deliberately for values that must not reach the server.

Query parameters can repeat

A query string may contain the same key more than once, and there is no specification saying what that means. PHP keeps the last occurrence unless the key ends in brackets; other stacks keep the first, or return an array. This inconsistency is exploited in HTTP parameter pollution attacks, where a proxy and an application disagree about which value counts. Never assume a key appears once.

The host is where security bugs live

Naive validation of a redirect target is a reliable source of open-redirect vulnerabilities. A string starting with a slash-slash is protocol-relative and points at another host entirely. Userinfo before an at-sign lets a URL appear to point at your domain while resolving elsewhere. Unicode characters that render like ASCII enable homograph domains. Parse the URL properly and compare the resolved host against an allowlist; never pattern-match the string.

Plus means different things in different places

In a query string, a plus sign conventionally means a space, because form encoding says so. In a path it is a literal plus. The same character therefore decodes differently depending on which part of the URL it is in, which is why email addresses with tagged aliases break so often.

Length limits are real but generous

The specification sets no limit, but browsers and servers do: around 2,000 characters is the practical ceiling for broad compatibility, and some servers reject longer request lines outright. Anything approaching that should be a POST body rather than a query string.