URL Encoding Ampersand: Escaping & and @ in Query Strings

What goes wrong

A search for "salt & pepper" naively becomes ?q=salt & pepper. The server parses q=salt and a second parameter named pepper, so the search runs for "salt" and nobody notices until someone reports odd results.

Encoded properly it is ?q=salt%20%26%20pepper — %26 is the ampersand, and the whole string arrives as one value.

The at sign

@ is reserved because it separates userinfo from host in a URL. Inside a path segment or a query value it should be %40.

In practice most servers accept a literal @ in a query string, which is why ?email=user@example.com usually works. "Usually" is the problem: a strict parser, a signature check or a proxy may disagree, so encode it and remove the question.

URL encoding is not HTML escaping

These two get confused constantly because both deal with ampersands. In a URL, & becomes %26. In HTML, & becomes &. They are different layers solving different problems.

When a URL appears inside an HTML attribute, both apply — first URL-encode the values, then HTML-escape the resulting URL:

<!-- value URL-encoded, then the whole href HTML-escaped -->
<a href="/search?q=salt%20%26%20pepper&amp;page=2">results</a>

Seeing & in an actual HTTP request means the HTML escaping leaked into the URL — the browser should have decoded it back to & before sending.