Endpoint BayISSUE #9 of 45

query strings · key=value · encoding

RestaVSThe 401 Bandit

Resta saysQuery strings pass key=value options in the URL after a ? — encoded for safety.

?page=2&sort=name&q=salt%20pepper carries options as key=value pairs joined by &. Values must be percent-encoded (spaces → %20, & → %26) so special characters don't break the structure. In JS, URLSearchParams builds and parses them correctly. Queries suit filtering, paging, and sorting — not sensitive data (URLs get logged).

Power-ups you unlock

?key=value&key2=value2
Percent-encode values (space → %20)
URLSearchParams builds/parses them
Use for filter/page/sort, not secrets

The 401 Bandit attacks — common mistakes

Raw spaces/& inside query values
Putting tokens in the query (logged in history/proxies)
Hand-concatenating instead of URLSearchParams

Boss battleBuild a query string with a space and an ampersand using URLSearchParams.

Example code

<!doctype html><html><head><meta charset="utf-8"></head>
<body style="background:#06040d;color:#e6e0ff;font-family:monospace;padding:20px"><pre id="o"></pre>
<script>const p=new URLSearchParams({q:'salt & pepper',page:2});document.getElementById('o').textContent='?'+p.toString();</script></body></html>

▶ Open the interactive comic issue

‹ Urls · Scheme · Host · Path · Query · Fragment Json · The Lingua Franca ›