HTTP URL - allowed characters in parameter names

Question

Is there any formal restriction as to which characters are allowed in URL parameter names?

I've been reading RFC3986 ("Uniform Resource Identifier (URI): Generic Syntax") but came to no definitive conclusion.

I know there are practical limitations, but would it actually be forbidden to do something like:

param with\funny<chars>=some_value

as long as I escape it correctly:

param%20with%1cfunny%3cchars%3e=some_value

Answer 1

There are no restrictions on escaped parameter names in the URI specs. There might be restrictions in the server-side software that you use, though. This is especially true if you use “homemade” scripts to interpret URIs.

Answer 2

There are reserved characters for URLs, but as long as you escape (urlencode) then you should be fine.

Depending on the framework used, you may get exceptions if you try to submit suspicious values. ASP.NET has content filtering that will throw exceptions if you try to submit "unsafe" data, like scripts or HTML. That's a feature of the framework though rather than a limitation or rule enforced by the URL syntax.

Answer 3

You should also read RFC2396. It seems to be more informative than RFC3986.