Question

I am trying to write a function to encode URIs in order to make them compliant with rfc 3986.

I.e. checking that every character other than alphanum; /?:@&=+$-_.!~*'()|\^[]``# gets replaced by %[hex octet]

I want to be sure that if the function gets called with an already encoded URI, the code won’t ruin it.

So far all I am doing is looking for a ‘%’ sign followed by 2 octect characters. Any other reserved character I find I replace.

Is there any other check I should be doing?

Don’t mind security issues; they are being handled somewhere else.

Answer 1

I think that properly-encoded URIs should always pass through cleanly the second time.

The reason being that you have to correctly parse a URI no matter what, because it’s entirely legal to have characters such as / @ . : ? & = in a URI, provided they appear in the right places.

So you only encode a character if it is not legal in that part of the URI. With that assertion, you then create an encoded string that IS legal at every position, so when you parse it, there is nothing left to encode.

Bear in mind that if someone throws a URI at you to be encoded and it happens to be ambiguous (ie it contains special characters that alter the URI syntax), they cannot expect a correct result.

To answer your question more directly, I would say yes: in light of all the above, you only need to have special treatment for the % escape sequences.