URL Encode Semicolon (;)

The semicolon (;) is a reserved character in URLs that historically served as an alternative parameter delimiter in path segments. While this usage has fallen out of favor, the semicolon still requires encoding as %3B when it appears as literal data in URLs.

Percent-encoded form: %3B represents the semicolon (ASCII code 59, hexadecimal 0x3B).

Historical context: RFC 3986 designates ; as a sub-delimiter, meaning it is reserved for scheme-specific or application-specific uses within a URL. The most notable historical use was matrix parameters (also called path parameters), where semicolons separated key-value pairs within a path segment: /products;color=red;size=large. Java-based frameworks like Spring and JAX-RS still support this syntax, but it is not widely used in modern web development.

JavaScript behavior:

encodeURIComponent(";")                    // "%3B"
encodeURIComponent("a=1;b=2;c=3")         // "a%3D1%3Bb%3D2%3Bc%3D3"
encodeURI("/path;param=value")            // "/path;param=value" (preserves ;)

Why encoding matters today:

• Some web application firewalls (WAFs) treat semicolons specially, potentially blocking or modifying requests
• Certain server frameworks parse semicolons as parameter delimiters, which can cause unexpected behavior
• In 2021, a critical cookie parsing vulnerability (HPP via semicolons) affected multiple frameworks because some treated ; as a cookie separator while others did not
• URLs containing semicolons may be truncated or mishandled in emails, chat applications, and certain link parsers

Common scenarios:

• Passing CSS property strings: ?style=color%3A%20red%3B%20font-size%3A%2014px
• Embedding SQL-like expressions in URL parameters
• Passing delimited lists where semicolons are the chosen separator
• JavaScript code snippets in URL parameters (educational tools, playgrounds)

Pitfall: If your application sits behind a Java-based proxy or server (like Apache Tomcat), be aware that it may strip or reinterpret semicolons in the URL path as matrix parameters, even if your application does not use them. This can silently truncate your URL paths. Encode semicolons in paths if your infrastructure includes Java-based components.