%3C is a less-than sign
%3C is a less-than sign, also called an angle bracket, and it is one of the characters attackers use to open a script tag reflected off a URL.
| Character | "<" |
|---|---|
| Name | Less Than |
| Encoded | %3C |
| Reserved | No |
Why it breaks things
A less-than sign has no place in a URL. RFC 3986 excludes it outright, the same category as the double quote and the backtick — never a valid literal character, encoded or not. Browsers percent-encode a typed or pasted < to %3C before a request is sent.
The everyday source of a raw < in a URL is a cross-site scripting attempt. An attacker appends something like <script>alert(1)</script> to a query value, hoping a page writes that value straight into its HTML without escaping it. If it does, the browser reads the raw <script> tag as real markup and runs it.
Percent-encoding the URL is not what stops this. %3C only controls how the character travels inside the URL — once the server decodes it back to a literal <, the danger is in how that value gets written into the page. The defence is output escaping: converting < to < where a value is placed into HTML, not anything done to the URL.
Real examples
Without encoding
https://example.com/comments?msg=<script>alert(1)</script>
With encoding
https://example.com/comments?msg=%3Cscript%3Ealert(1)%3C%2Fscript%3E
A browser will percent-encode the raw form automatically before sending it, so this is not really a two-state comparison. What matters is what the server does after decoding msg back to a literal <script> tag — if it writes that value into the page's HTML unescaped, the script runs regardless of how the URL was encoded.
Without encoding
https://example.com/search?filter=price<100
With encoding
https://example.com/search?filter=price%3C100
An ordinary comparison, nothing malicious. The raw < is still not valid in a URL, so a browser encodes it to %3C on its own before the request goes out — this example just shows the mundane, non-attack case of the same rule.
Decode something
Result
Breakdown
| Part | Value | Copy |
|---|
History
Nothing yet.
History stays in this browser. It is never sent to our server.
Common questions
- Can a raw less-than sign ever appear in a URL?
- No. RFC 3986 excludes it, and browsers percent-encode a literal < automatically before a request is sent, so a URL never actually carries the raw character over the wire.
- Does percent-encoding a URL stop cross-site scripting?
- No. Encoding only affects the URL itself. The vulnerability appears later, when a server decodes a value and writes it into an HTML page without escaping it. The fix is output escaping at that point, not URL encoding.
- Why doesn't pasting <script> into my address bar run anything?
- The address bar just navigates to that address; it does not insert the text into a page as HTML. The risk only appears if a server takes that same value from the URL and reflects it, unescaped, into a page it renders.
- Is %3C related to %3E?
- Yes, they are the opening and closing half of the same angle-bracket pair, and both are excluded from URLs by RFC 3986 in the same way.