Doubleencoding

Doubleencoding refers to the practice of encoding data more than once using one or more encoding schemes. Common schemes include URL percent-encoding, HTML entity encoding, and Unicode escaping. Doubleencoding can happen intentionally or inadvertently as data passes through multiple layers of a system that each apply their own encoding.

In web applications, doubleencoding often arises when input is encoded for transport, stored, and later re-encoded for rendering. This can produce output that is decoded multiple times, leading to mismatches between validation and rendering. Doubleencoding can complicate security controls, sometimes allowing encoded content to bypass filters or to appear differently after decoding, and it can also cause data integrity problems or rendering glitches.

A typical illustration is a character such as < that is encoded as %3C in a URL, and the result is then encoded again, producing %253C. While this is a simplified example, similar patterns occur with various encodings and character sets. The risk is most acute in interfaces that sanitize input only once or assume a single decoding step before rendering.

Mitigation focuses on consistency and defense in depth. Normalize or canonicalize input data at a single boundary, avoid applying multiple encodings across layers, and decode data in a controlled, context-aware manner. Use output encoding appropriate to the rendering context, validate inputs with strict policies, and employ comprehensive security measures such as content security policies and robust escaping libraries to reduce the impact of accidental or malicious doubleencoding.