Do I need to escape forward slashes in a URL query string?

Question

For example, is this valid and expresses key = "ab/cd":

http://example.com?key=ab/cd

or do I have to percent % encode the / as in:

http://example.com?key=ab%2Fcd

Answer 1

I don't think encoding is needed according to the URL RFC https://datatracker.ietf.org/doc/html/rfc3986#section-3.4 which says:

query = *( pchar / "/" / "?" )

characters slash ("/") and question mark ("?") may represent data within the query component. Beware that some older, erroneous implementations may not handle such data correctly when it is used as the base URI for relative references (Section 5.1), apparently because they fail to distinguish query data from path data when looking for hierarchical separators. However, as query components are often used to carry identifying information in the form of "key=value" pairs and one frequently used value is a reference to another URI, it is sometimes better for usability to avoid percent- encoding those characters.

pchar is defined earlier as:

pchar         = unreserved / pct-encoded / sub-delims / ":" / "@"

and / is not in unreserved, but the above quote shows that it is explicitly allowed in the query string.