How about CGI::escape()? It translates everything except [a-zA-Z0-9_.-]. If it doesn't do what you want, you can always grab the four or five line definition out of CGI.pm and customize it for your needs.