You can just use urldecode
$query = urldecode('category%5B%5D=garden&tags%5B%5D=shrubs'); //category[]=garden&tags[]=shrubs
Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.
After receiving some great tips and advice from the community, I wanted to ask peoples view on whether to leave URL parameters encoded (but less visually appealing) or to pre_replace to tidy them up.
I am not adverse to either, but just wondered whether their was any disadvatage/advatgaes or security related concerns - or is it just best to keep the parameter encoded as per the query builder
Current:
mysite.com/posts?category%5B%5D=garden&tags%5B%5D=shrubs
Current preg_replace to "tidy the URL" to remove the index within the array but to keep the URL encoded
$query = preg_replace('/%5B[0-9]+%5D/', '%5B%5D', $query);
Possible preg_replace to give a "Best vanity" / clean URL
$query = preg_replace('/%5B[0-9]+%5D/', '[]', $query);
This version would produce URLs like
mysite.com/posts?category[]=garden&tags[]=shrubs
Does anybody have any thoughts on tidying the URLs or does exposing the array as square bracket params open up security issues?
Cheers
Please or to participate in this conversation.