Encoding the minimum characters in a POST request: is it safe or not?

Question

I came up with an approach to encoding only four characters in the value of the POST: parameter # ; & +. What problems can arise if they exist?

Personally, I don't like these hacks. The reason I ask about this is because I have an argument with its inventor.

Update. . To clarify, this question concerns the encoding parameters in the body of the POST, and not about escaping the POST parameters on the server side, for example. d. before submitting them to a shell, database, HTML page or something else.

Answer 1

rfc1738 ( application/x-www-form-urlencoded ):

:

. , , , URL- . "<" " > " , URL- ; ( "" ) URL- . "#" , World Wide Web , URL- / , . "%" , . , , . : "{", "}", "|", "\", "^", "~", "[", "]" "`".

URL-. , "#" URL- , , , URL- , , URL-.

Answer 2

(?) . , . . , (, ). , , .

, . SQL, HTML , .

Answer 3

: $sql ='DELETE * from articles WHERE id ='.$_POST['id'].';
: 1' OR '10
: $sql ='DELETE * from articles WHERE id ='1' OR '10';