script displays the inputs sent from the client on the standard error stream to avoid any additional translations (for our locally running web server in example - this routes the printed text to the server' console windowexample - pp \internet\web\cgi-bin\badlink py import cgisys form cgi fieldstorage(print all inputs to stderrstodout=reply page for name in form keys()print('[% :% ](nameform[namevalue)end='file=sys stderrfollowing is the (edited for spaceoutput we get in our local python-coded web server' console window for following each of the three links in the html page in turn using internet explorer the second and third yield the correct parameters set on the server as result of the html escaping or url conventions employedbut the accidental html escapes cause serious issues for the first unescaped link--the client' html parser translates these in unintended ways (results are similar under chromebut the first link displays the non-ascii section mark character with different escape sequence)mark-vaio [ /jun/ : : '[: \xa = <= [job: [name:amark-vaio [ /jun/ : : cgi script exited ok mark-vaio [ /jun/ : : '[amp: [job: [lt: [name: [sect: ]mark-vaio [ /jun/ : : cgi script exited ok mark-vaio [ /jun/ : : '[amp: [job: [lt: [name: [sect: ]mark-vaio [ /jun/ : : cgi script exited ok the moral of this story is that unless you can be sure that the names of all but the leftmost url query parameters embedded in html are not the same as the name of any html character escape code like ampyou should generally either use semicolon as separatorif supported by your toolsor run the entire url through cgi escape after escaping its parameter names and values with urllib parse quote_pluslink 'file py?name= &job= &amp= &sect= &lt=eescape for html import cgi cgi escape(link'file py?name= &amp;job= &amp;amp= &amp;sect= &amp;lt=eescape for url import urllib parse elink urllib parse quote_plus(linkelink 'file py% fname% da% job% db% amp% dc% sect% dd% lt% deurl satisfies html toosame cgi escape(elink'file py% fname% da% job% db% amp% dc% sect% dd% lt% de server-side scripting