%27 is an apostrophe
%27 is an apostrophe — RFC 3986 allows it raw everywhere, but browsers percent-encode it automatically in a query string while leaving it untouched in a path or fragment.
| Character | "'" |
|---|---|
| Name | Apostrophe |
| Encoded | %27 |
| Reserved | Yes — it has a special meaning in a URL |
Why it breaks things
The apostrophe is a sub-delimiter under RFC 3986, the same group as the comma — reserved for a scheme to give meaning to, with no fixed job of its own. That is different from a gen-delim like / or ?, which always does the same work. Because nothing treats it specially at the syntax level, a raw apostrophe is legal wherever a sub-delimiter is allowed — the path, the query, and the fragment alike.
Browsers do not treat those three parts the same way, though. Verified with a standards-compliant URL parser: a raw apostrophe in a path or a fragment is left exactly as typed — /path/O'Brien and #O'Brien both come through unchanged. The query string is different: https://example.com/directory?name=O'Brien parses to a search value of ?name=O%27Brien, encoded automatically for an http or https address. That is the WHATWG URL standard's special-query percent-encode set at work — and it is why both examples below, which are query strings, show a browser encoding the apostrophe on its own rather than passing it through.
Encoding it yourself anyway is common defensive practice, for reasons that have nothing to do with URL parsing. An apostrophe can end a single-quoted HTML attribute early if dropped in unescaped. One thing it does not do: percent-encoding a value is not a defence against SQL injection. That is fixed with parameterized queries, not URL encoding.
Real examples
Without encoding
https://example.com/directory?name=O'Brien
With encoding
https://example.com/directory?name=O%27Brien
The raw apostrophe is valid in the URL itself and reaches the server intact either way. Encoding it matters once the value is echoed back into HTML — a template that drops it into a single-quoted attribute, like value='O'Brien', closes the attribute early and breaks the markup.
Without encoding
https://example.com/api/search?lastName=D'Angelo
With encoding
https://example.com/api/search?lastName=D%27Angelo
Percent-encoding here does not make the value SQL-safe. After the server decodes the query string, both versions are just the text D'Angelo — if the backend builds a query by pasting that straight into a string like WHERE last_name = '...', the apostrophe still closes the string early. That is fixed with a parameterized query, not with URL encoding.
Decode something
Result
Breakdown
| Part | Value | Copy |
|---|
History
Nothing yet.
History stays in this browser. It is never sent to our server.
Common questions
- Do I need to percent-encode an apostrophe in a URL?
- Not for the URL to stay valid — RFC 3986 lists it as a sub-delimiter, legal to use unencoded anywhere in a URL. What happens on the wire varies by part: a browser leaves a raw apostrophe alone in a path or fragment, but encodes it to %27 automatically in a query string. Encoding it yourself is a defensive habit for what happens to the value later, not a requirement of the URL itself.
- Does encoding an apostrophe protect against SQL injection?
- No, and this is a common misunderstanding. Percent-encoding only affects how a value travels inside a URL — once the server decodes it, the apostrophe is back to being a literal character. SQL injection is prevented by parameterized queries or prepared statements at the database layer, not by anything done to the URL.
- Why did a customer's name with an apostrophe break my web page?
- Almost always because the value was placed into a single-quoted HTML attribute, or a hand-built string, without escaping for that specific context. The fix is proper HTML or string escaping where the value is used, separate from whatever encoding it had in the URL.
- Is %27 treated differently from %22?
- Yes. A double quote is banned everywhere in a URL and browsers encode it automatically in every part. An apostrophe is a legal sub-delimiter, so a browser leaves a raw one alone in a path or fragment — but it still encodes one automatically in a query string, which is exactly where %27 shows up most in ordinary browsing.