' % % cstuff% cspam txtx urllib parse quote_plus(" # " ' +% + +% % +curllib parse unquote_plus( ' #curl escape sequences embed the hexadecimal values of nonsafe characters following sign (this is usually their ascii codesin urllib parsenonsafe characters are usually taken to include everything except lettersdigitsand handful of safe special characters (any in ' -')but the two tools differ on forward slashesand you can extend the set of safe characters by passing an extra string argument to the quote calls to customize the translationsurllib parse quote_plus("uploads/index txt"'uploads% findex txturllib parse quote("uploads/index txt"'uploads/index txturllib parse quote_plus("uploads/index txt"'/''uploads/index txturllib parse quote("uploads/index txt"'/''uploads/index txturllib parse quote("uploads/index txt"'''uploads% findex txturllib parse quote_plus("uploads\index txt"'uploads% cindex txturllib parse quote("uploads\index txt"'uploads% cindex txturllib parse quote_plus("uploads\index txt"'\\''uploads\\index txtnote that python' cgi module also translates url escape sequences back to their original characters and changes signs to spaces during the process of extracting input information internallycgi fieldstorage automatically calls urllib parse tools which unquote if needed to parse and unescape parameters passed at the end of urls the upshot is that cgi scripts get back the originalunescaped url stringsand don' need to unquote values on their own as we've seencgi scripts don' even need to know that inputs came from url at all escaping urls embedded in html code we've seen how to escape text inserted into both html and urls but what do we do for urls inside htmlthat ishow do we escape when we generate and embed text inside urlwhich is itself embedded inside generated html codesome of our earlier examples used hardcoded urls with appended input parameters inside more on html and url escapes