Decode data once and keep HTML escaping separate
03Percent escapes carry bytes inside URI components. They are different from HTML entity escaping and from form encodings that use plus for space.
The href attribute source contains & between subject and body. HTML parsing yields a URI with an actual & separator, then URI parsing yields two fields. Do not treat amp;body as a field name.
Source for this drawing: RFC 6068 · Read RFC section 5 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
- CRLF
- Carriage Return followed by Line Feed, represented in a URI body by %0D%0A.
- MIME
- Multipurpose Internet Mail Extensions: message body formats and encodings for email.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Split syntax first, decode data once, and escape the enclosing context separately.
- Within query values, ? = & must be escaped when they are data rather than delimiters; # in hfields MUST be %23. Fragments are meaningless here, SHOULD NOT be used and SHOULD be ignored on resolution.
- Body line breaks MUST be %0D%0A. Spaces SHOULD be %20; literal + is not an unambiguous space encoding, and + MAY be encoded as %2B. A final body line break MAY be added; line breaks in other hfields SHOULD NOT be used.
- Encoding/decoding must be applied only once at the appropriate layer. URI strings MUST be decoded before creating the message and SHOULD be decoded before display. In HTML/XML source, the URI query separator & needs context escaping such as &; this is not a different mailto field name.
The body pseudo-field supplies short text for the first text/plain part, not arbitrary MIME bodies or attachments. It uses UTF-8/percent encoding in the URI, not an added base64 layer. The HTML example intentionally omits recipients, which the user must provide before sending. Displayed markup is illustrative source, not an activated mailto link.
Read the RFC section ↗