What is Query String?
Query String is the part of a URL that contains data to be passed to web applications, appearing after the question mark (?) and consisting of key-value pairs separated by ampersands (&).
Quick Facts
| Full Name | URL Query String |
|---|---|
| Created | 1994 (RFC 1738 - URL specification) |
| Specification | Official Specification |
How It Works
A query string is a way to pass parameters in a URL to a server or web application. It starts with a question mark (?) and contains one or more key=value pairs separated by ampersands (&). For example, in the URL 'https://example.com/search?q=hello&lang=en', the query string is 'q=hello&lang=en'. Query strings are used extensively for search parameters, pagination, filtering, tracking codes, and passing data between pages. Special characters in query strings must be URL-encoded (percent-encoded), for instance, spaces become %20 or +. While convenient for bookmarkable URLs and GET requests, query strings have limitations: they're visible in browser history, have length limits (typically 2048 characters), and shouldn't contain sensitive data. For complex data, consider POST requests with body data instead.
Key Characteristics
- Starts with ? and follows the URL path
- Key-value pairs separated by & symbol
- Values must be URL-encoded for special characters
- Visible in browser address bar and history
- Subject to length limitations (browser/server dependent)
- Used primarily with HTTP GET requests
Common Use Cases
- Search engine queries (q=search+term)
- Pagination parameters (page=2&limit=10)
- Filtering and sorting data (?sort=date&order=desc)
- UTM tracking codes for marketing analytics
- Passing state between pages without sessions
Example
Loading code...Frequently Asked Questions
What is the maximum length of a query string?
There is no official limit in the HTTP specification, but browsers and servers impose practical limits. Most browsers support URLs up to 2,048 characters, while some servers may accept longer URLs. For reliable cross-browser compatibility, keeping query strings under 2,000 characters is recommended.
How do I handle special characters in query strings?
Special characters must be URL-encoded (percent-encoded). For example, spaces become %20 or +, ampersands become %26, and equals signs become %3D. In JavaScript, use encodeURIComponent() to encode values, or the URLSearchParams API which handles encoding automatically.
What is the difference between query strings and URL fragments?
Query strings (after ?) are sent to the server and used for server-side processing, while URL fragments (after #) are only processed client-side and never sent to the server. Fragments are typically used for in-page navigation or client-side routing in single-page applications.
Can query strings contain arrays or nested objects?
Yes, but there is no standard format. Common conventions include repeated keys (colors=red&colors=blue), bracket notation (colors[]=red&colors[]=blue), or comma-separated values (colors=red,blue). For complex data structures, consider using POST requests with JSON body instead.
Are query strings secure for sensitive data?
No, query strings should not contain sensitive data like passwords or API keys. They are visible in browser history, server logs, referrer headers, and can be cached. For sensitive data, use POST requests with HTTPS, store data in request headers, or use secure cookies.