To encode data in a URL, you can call CGI::escapeHTML() directly.
URL escaping is different from HTML escaping.
I think the OP needs a module like
URI::Escape. Observe the following code:
$ perl
use CGI;
use URI::Escape;
my $orig = q{a9: _-;&<tag>'"};
printf "HTML escaped: %s\n", CGI->escapeHTML($orig);
printf "URL escaped: %s\n", uri_escape($orig);
^D
HTML escaped: a9: _-;&<tag>'"
URL escaped: a9%3A%20_-%3B%26%3Ctag%3E'%22
Most mainstream browser can recover from common broken (unescaped) urls -
space seem to be the most common.
But rfc2396 is clear in this regard:
2.4.3. Excluded US-ASCII Characters
Although they are disallowed within the URI syntax, we include here
+ a
description of those US-ASCII characters that have been excluded an
+d
the reasons for their exclusion.
<SNIP>
The space character is excluded because significant spaces may
disappear and insignificant spaces may be introduced when URI are
transcribed or typeset or subjected to the treatment of word-
processing programs. Whitespace is also used to delimit URI in man
+y
contexts.
space = <US-ASCII coded character 20 hexadecimal>
<SNIP>
Data corresponding to excluded characters must be escaped in order
+to
be properly represented within a URI.
Named entities (like those generated
by escapeHTML) are simply names for characters and do not
represent URL escaping.
Test HTML snippet:
<a href="http://google.com/search?q=super search">unescaped space</a>
<a href="http://google.com/search?q=super%20search">escaped space</a>
<a href="http://google.com/search?q=super&search">entity amp</a>
<a href="http://google.com/search?q=super%26search">url-escaped amp</a
+>
Attn. OP:
Passing SQL statements this way is a security hole.
-
Are you posting in the right place? Check out Where do I post X? to know for sure.
-
Posts may use any of the Perl Monks Approved HTML tags. Currently these include the following:
<code> <a> <b> <big>
<blockquote> <br /> <dd>
<dl> <dt> <em> <font>
<h1> <h2> <h3> <h4>
<h5> <h6> <hr /> <i>
<li> <nbsp> <ol> <p>
<small> <strike> <strong>
<sub> <sup> <table>
<td> <th> <tr> <tt>
<u> <ul>
-
Snippets of code should be wrapped in
<code> tags not
<pre> tags. In fact, <pre>
tags should generally be avoided. If they must
be used, extreme care should be
taken to ensure that their contents do not
have long lines (<70 chars), in order to prevent
horizontal scrolling (and possible janitor
intervention).
-
Want more info? How to link
or How to display code and escape characters
are good places to start.