What characters can go into a valid HTTP URL?
Section 5 of RFC 1738 – Uniform Resource Locators specifies the format of an HTTP URL:
xxxxxxxxxx1
httpurl = "http://" hostport [ "/" hpath [ "?" search ]][definition of hostport omitted]hpath = hsegment *[ "/" hsegment ]hsegment = *[ uchar | ";" | ":" | "@" | "&" | "=" ]search = *[ uchar | ";" | ":" | "@" | "&" | "=" ]uchar = unreserved | escapeunreserved = alpha | digit | safe | extraalpha = lowalpha | hialphalowalpha = "a" | "b" | "c" | "d" | "e" | "f" | "g" | "h" | "i" | "j" | "k" | "l" | "m" | "n" | "o" | "p" | "q" | "r" | "s" | "t" | "u" | "v" | "w" | "x" | "y" | "z"hialpha = "A" | "B" | "C" | "D" | "E" | "F" | "G" | "H" | "I" | "J" | "K" | "L" | "M" | "N" | "O" | "P" | "Q" | "R" | "S" | "T" | "U" | "V" | "W" | "X" | "Y" | "Z"digit = "0" | "1" | "2" | "3" | "4" | "5" | "6" | "7" | "8" | "9"safe = "$" | "-" | "_" | "." | "+"extra = "!" | "*" | "'" | "(" | ")" | ","escape = "%" hex hexhex = digit | "A" | "B" | "C" | "D" | "E" | "F" | "a" | "b" | "c" | "d" | "e" | "f"The “path” and the “query string” parts can contain alphabets, numbers the following characters: $-_.+!*’(,;:@&=/
They can also contain escaped forms (“%” (percent) followed by 2 hex values, i.e. %[A-Fa-f0-9]{2}, for each byte) of other characters.