Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

Adam_Commit's avatar

URL Encoding - to preg replace or not

After receiving some great tips and advice from the community, I wanted to ask peoples view on whether to leave URL parameters encoded (but less visually appealing) or to pre_replace to tidy them up.

I am not adverse to either, but just wondered whether their was any disadvatage/advatgaes or security related concerns - or is it just best to keep the parameter encoded as per the query builder

Current:

mysite.com/posts?category%5B%5D=garden&tags%5B%5D=shrubs

Current preg_replace to "tidy the URL" to remove the index within the array but to keep the URL encoded

$query = preg_replace('/%5B[0-9]+%5D/', '%5B%5D', $query);

Possible preg_replace to give a "Best vanity" / clean URL

$query = preg_replace('/%5B[0-9]+%5D/', '[]', $query);

This version would produce URLs like

mysite.com/posts?category[]=garden&tags[]=shrubs

Does anybody have any thoughts on tidying the URLs or does exposing the array as square bracket params open up security issues?

Cheers

0 likes
2 replies
Sinnbeck's avatar

You can just use urldecode

$query = urldecode('category%5B%5D=garden&tags%5B%5D=shrubs'); //category[]=garden&tags[]=shrubs
Adam_Commit's avatar

Thank you @sinnbeck is their any advatange/disadvantage to this, I would prefer to decode to clean the URI but wan't sure if there was a reason that the query builder didn't decode by default and thus is their a reason not to decode. :)

Please or to participate in this conversation.