Double URL Encoding Bypass

TL;DR

Explanation

URL encoding: %27 = '. Double encoding: %2527 = %27 = '. If a WAF or filter decodes once and checks, then the application decodes again, the second decode reveals the payload. Common in path traversal (%2e%2e%2f = ../), XSS (%253Cscript%253E), and SQL injection. PHP's urldecode() and $_GET automatic decoding create opportunities. Defences: filter after all decoding is complete, use parameterised queries (immune to encoding tricks), validate against a whitelist of allowed characters after normalisation, use realpath() to resolve paths before checking.

Common Misconception

Why It Matters

Common Mistakes

• Filtering raw $_GET without checking if values are further encoded.
• Path traversal checks that operate before realpath() normalisation.
• Trusting WAF filtering without validating at the application layer.

Code Examples

// Checks for ../ but misses %2e%2e%2f or %252e%252e%252f:
if (strpos($_GET['file'], '../') !== false) {
    die('Invalid path');
}
readfile('/uploads/' . $_GET['file']);

$file = $_GET['file'] ?? '';
// Fully normalise before validating
$path = realpath('/uploads/' . $file);
if ($path === false || !str_starts_with($path, '/uploads/')) {
    http_response_code(400); die('Invalid path');
}
readfile($path);

References

• ↗ https://owasp.org/www-community/Double_Encoding

Tags

Related Terms