A query string and an HTML page do not escape text the same way.

This string is fine in a sentence:

<Hello World> & "KeptTools"?q=1

Enter fullscreen mode

Exit fullscreen mode

Put it in a URL without encoding, and & starts a new parameter. Put it in HTML without escaping, and < starts a tag. Those are two different jobs.

I use a small encoder for both. It runs in the browser, so the string is not uploaded.

https://kepttools.com/url-html-encoder

URL encoding

URL encoding turns characters that have a special meaning in a URL into % sequences.

The tool uses encodeURIComponent , which is the right function for a query value or a path segment. The sample becomes:

%3CHello%20World%3E%20%26%20%22KeptTools%22%3Fq%3D1

Enter fullscreen mode

Exit fullscreen mode

< is %3C , a space is %20 , & is %26 , " is %22 , and ? is %3F .

encodeURI is the other common function, and it is not the same. It leaves & , ? , and = alone, because those characters structure a full URL.…