Why is the comma URL encoded?

Question

When debugging in ASP.NET MVC, I don't see a difference between:

http://mysite.com?q=hi,bye

and

http://mysite.com?q=hi%2Cbye

The querystring param "q" always has a value of "hi,bye".

So why is the comma encoded?

I want to do something like this https://stackoverflow.com/a/752109/173957.

I have this form:

<form method="GET" action="/Search">
     <input type="hidden" name="q" value="hi,bye"/>
     <input type="submit" value="ok"/>
</form>

How can I prevent this value from being encoded?

Solution 1

The URI spec, RFC 3986, specifies that URI path components not contain unencoded reserved characters and comma is one of the reserved characters. For sub-delims such as the comma, leaving it unencoded risks the character being treated as separator syntax in the URI scheme. Percent-encoding it guarantees the character will be passed through as data.

Solution 2

I found this list of characters that do not require URL encoding: http://urldecoderonline.com/url-allowed-characters.htm

Update
Since the original link broke, I used archive.org to get the following text from the page from on December 2013

List of allowed URL characters

Unreserved - May be encoded but it is not necessary

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
a b c d e f g h i j k l m n o p q r s t u v w x y z
0 1 2 3 4 5 6 7 8 9 - _ . ~

Reserved - Have to be encoded sometimes

! * ' ( ) ; : @ & = + $ , / ? % # [ ]

Solution 3

This is really browser dependent. The browser takes the HTML form and decides how to build the URL based on the form's inputs.

If you're using a really old (or poorly programmed) browser, it may not encode the comma. If you adhere to RFC standards, it really should be encoded.

If you want to prevent the comma from being encoded for all browsers, you would have to use JavaScript and build the URL yourself.

<script lang="JavaScript">
    document.location.href = "/Search?q=hi,bye";
</script>

In any case, it shouldn't matter, because you should be decoding the querystring parameters anyway, and the result will be the same.