Name the immediate destination
Suppose a search value is A&B "C". In a URL query component, the ampersand would normally separate parameters, so it must be encoded as part of the value before the query string is assembled. In HTML text, an ampersand can introduce a character reference, and an angle bracket could introduce markup. Inside a JavaScript string literal, quotation marks and backslashes have their own syntax. These are three distinct parsing contexts. An output safe for one is not automatically safe for the next. A production application should use context-aware platform APIs and templates rather than assemble markup by concatenation.
Work the first boundary
If the query key is q, encode the value as one URL component and then place it after q=. The ampersand becomes %26 and the quotation marks are represented according to the URL encoder’s rules. Encoding the entire finished URL as though it were a value would also encode its structural punctuation and produce the wrong address. If the resulting URL is displayed as link text in an HTML page, the text node then needs HTML-safe representation. If it is placed in an HTML attribute, use an attribute-safe serializer, which has its own quoting rules.
- Raw value: A&B “C”
- URL component: encode reserved query characters
- HTML or JavaScript output: escape for that destination
Do not make JavaScript the transport format
A script may need to store the original value in a quoted literal, which calls for JavaScript string escaping. That is a source-code concern, not a substitute for URL component encoding or HTML output encoding. Avoid placing untrusted input directly inside inline script source; using data attributes or a script element with carefully serialized JSON can be safer when implemented by maintained frameworks. The MultiVerto JavaScript escape tool illustrates string-literal characters, but cannot certify that a whole application is safe against script injection. Security depends on the actual parser context and surrounding code.
Decode in the opposite order
At the receiving end, a URL parser extracts q and percent-decodes the component once. An HTML parser processes entities while constructing its document; a browser does not percent-decode ordinary text just because it appears on a page. JavaScript interprets its own literal escapes when it parses source code. Applying the wrong decoder can leave visible sequences such as %26 or create data that is then interpreted as syntax in another context. Keep the original raw value separate from each serialized representation so that a user-facing display does not accidentally become the next processing input.
A review checklist for a real app
Draw the path from source value to URL component, then to HTML text or attribute, and only then to any script usage. At each arrow, choose the API for that exact destination and test characters such as ampersand, quote, less-than sign and non-ASCII letters. Check the final rendered page and the resulting parsed URL, not only an intermediate encoded string. Escaping does not grant trust or validate a link target; separate policy checks may still be required. The linked converters help demonstrate each layer with a small sample before you implement it in a framework.