URL encoder/decoder · Guide
URL Encode Apostrophe: Single Quotes in URLs
Apostrophes appear in real data constantly — surnames, place names, ordinary text. They pass through URLs unencoded most of the time, which makes the cases where they do not more surprising.
The rule and the practice
RFC 3986 lists ' as a sub-delimiter, so %27 is the correct escape when it appears as data. No server parses it structurally, so an unencoded apostrophe in a query string works fine.
encodeURIComponent leaves it alone; PHP rawurlencode encodes it as %27. That difference is harmless in normal use and matters for request signatures, where both sides must encode identically.
Where it does cause trouble
HTML attributes. A URL containing a literal apostrophe placed inside single-quoted markup ends the attribute early:
<!-- broken: the apostrophe closes the attribute -->
<a href='/search?q=O'Brien'>link</a>
<!-- fixed: encode in the URL, escape for HTML -->
<a href="/search?q=O%27Brien">link</a>JavaScript string literals have the same issue, and shell commands a third variant — each layer needs its own escaping, and encoding for one does not cover the others.
It is not an injection defence
Encoding an apostrophe as %27 is a transport concern. The server percent-decodes it back to ' before your code ever sees it, so the value reaching your database layer is identical either way.
SQL injection is prevented by parameterised queries, never by URL encoding. Treating %27 as a security measure is a misunderstanding that leaves the actual hole open — and a WAF that blocks %27 blocks legitimate surnames while an attacker uses a different encoding.
Frequently asked questions
Does an apostrophe need encoding in a URL?
Strictly it should be %27, but unencoded apostrophes work in practice. Encode it when building HTML attributes or signing requests.
Does encoding it prevent SQL injection?
No. The server decodes it before your code runs. Use parameterised queries.
Why does my link break on names like O'Brien?
The apostrophe terminated a single-quoted HTML attribute. Use %27 in the URL and double-quoted attributes.
Ready to try it?
Open the free browser-based URL encoder/decoder and apply what you just read — no sign-up, runs locally.
Open the URL encoder/decoder tool