Nested URL in Query Parameter – Encode & and = Inside Redirect URLs

Local only

Show why embedded URLs must percent-encode their own query delimiters when used as an outer query value.

46 chars · 1 line

64 chars · 4 lines

2 parameters2 unique keys

Nested URL query parameter

Why an embedded URL must be encoded inside a query value

When a redirect or callback URL is placed inside another query string, its raw ampersands are indistinguishable from the outer query separators. Percent-encode the embedded URL so it remains one value. This tool is free to use. No account or payment is required.

Last updated

What you can do here

  • Browser-native URLSearchParams behavior
  • Full URL and raw query parsing
  • Repeated parameter preservation
  • JSON object to query construction
  • Browser-local processing

Steps

  1. Paste the outer query into Parse to JSON.
  2. Check whether the embedded URL contains raw & or = delimiters.
  3. Percent-encode the complete embedded URL value before adding it to the outer query.

The outer parser cannot infer which & belongs to the inner URL

In ?redirect=https://example.com/callback?a=1&b=2, the raw & starts a new outer parameter named b.

When the redirect value is percent-encoded, its %26 and %3D sequences are decoded only after the outer parameter boundary has been established.

Unencoded redirect URL

The inner b=2 becomes a separate outer parameter.

Query string

?redirect=https://example.com/callback?a=1&b=2

Parsed JSON

{
  "redirect": "https://example.com/callback?a=1",
  "b": "2"
}

Common questions

Frequently asked questions

Why is only part of the redirect URL preserved?

The first raw & is interpreted as the next outer query parameter separator.

Should I encode only the ampersand?

Encoding the whole nested URL as one query-component value is usually safer than manually escaping individual delimiters.

Does this also apply to return_url and callback parameters?

Yes. Any complete URL nested inside another query value needs component-safe encoding.

Debugging a specific Query String issue? Browse Query String troubleshooting.