escape_url
Escapes a value for use as a query-string value.
It does not validate URL schemes, so it never turns an attacker-controlled string into a safe href on its own. A "javascript:" payload stays a live scheme if you drop the whole URL into href unescaped. Scalar values are coerced to their string form before escaping.
InputArgumentsReturns
Sourceanyno argumentsstringBasicSource
Escapes text for use as a query-string value.
Given
{"q": "a b&c=d"}Template
{{ q | escape_url }}Result
a+b%26c%3DdPercentSource
Percent-encodes a literal percent sign and space so the value survives a query string.
Given
{"promo": "50% off!"}Template
{{ promo | escape_url }}Result
50%25+off%21SlashSource
Percent-encodes a slash so a value stays a single query parameter.
Given
{"path": "docs/getting-started"}Template
{{ path | escape_url }}Result
docs%2Fgetting-startedUnicodeSource
Percent-encodes each byte of a multi-byte character.
Given
{"term": "café"}Template
{{ term | escape_url }}Result
caf%C3%A9