For the URI query value use urlencode/urldecode; for anything else use rawurlencode/rawurldecode.

To create entire query string use http_build_query()

The difference between urlencode and rawurlencode is that

• urlencode encodes according to application/x-www-form-urlencoded (space is encoded with +) while
• rawurlencode encodes according to the plain Percent-Encoding (space is encoded with %20).

URLEncode is meant to encode characters that have special meanings in URLs (like colons, question marks, slashes etc.).

You should only apply URLEncode to the values you wish to encode in your URL, not to the entire URL.

E.g. Suppose I have the following URL:

http://example.com/search.php?query=VALUE

As it stands, no escaping is necessary. But suppose VALUE was actually

/. the book

The VALUE bit now contains a character that is not safe as a slash has special meaning in an URL.

So before I attach the VALUE to the URL, I need to URLEncode just the VALUE.

http://example.com/search.php?query=%2F.%20the%20book

When a webserver gets the above request it will need to URLDecode the query parameter to make get the original text back.

In the example cited in the question, the entire query string was being encoded. This is incorrect as special characters (such as ampersands between query parameters) are then escaped and not interpreted correctly. You should only encode the parameter values.

You can use the function html_entity_decode() and the HTML entitycode for ² which is ².

Your code will look something like this:

<meta charset="utf-8">

<script>
    document.write(encodeURIComponent(';<?php echo html_entity_decode("&sup2;") ?>'));
</script>