Take the 2-minute tour ×

What is the meaning of a ^ sign in a URL?

I needed to crawl some link data from a webpage and I was using a simple handwritten PHP crawler for it. The crawler usually works fine; then I came to a URL like this:


This URL works fine when typed in a browser but my crawler is not able to retrieve this page. I am getting an "HTTP request failed error".

share|improve this question
interesting sql in query string, little bobby drop tables joke next. xkcd.com/327 –  John Boker Feb 24 '10 at 20:12
Do you believe that the SQL inside the ^ signs is being directly executed? –  Kshitij Saxena -KJ- Feb 24 '10 at 20:13
i dont know, do you? if i were passing data on a query string i'd only pass the parameters, then build a parameterized query or use a stored proc. –  John Boker Feb 24 '10 at 20:13
http://www.example.com/example.asp?x7=3^^^^^drop%20table%20table^^^^^ –  Anon. Feb 24 '10 at 20:14
someone hasn't learnt about SQL injection yet. –  JL. Feb 24 '10 at 20:18

5 Answers 5

up vote 5 down vote accepted

Caret (^) is not a reserved character in URLs, so it should be acceptable to use as-is. However, if you re having problems, just replace it with its hex encoding %5E.

And yeah, putting raw SQL in the URL is like a big flashing neon sign reading "EXPLOIT ME PLEASE!". Whoever designed the site in question is brain-dead.

share|improve this answer
It isn't reserved, but it also isn't "unreserved", meaning it "must be escaped" according to RFC2396, section 2.4. –  Laurence Gonsalves Feb 24 '10 at 20:18
RFC 2396 is obsoleted by 3986, though the point about it not being "unreserved" still applies. –  Anon. Feb 24 '10 at 20:20
@Anon true, but 3986 spreads the relevant information around so much that I couldn't find a good single place to cite. RFC 2396 is still mostly correct for all practical purposes. –  Laurence Gonsalves Feb 24 '10 at 20:27

Based on the context, I'd guess they're a homespun attempt to URL-encode quote-marks.

share|improve this answer

^ characters should be encoded, see RFC 1738 Uniform Resource Locators (URL):


All unsafe characters must always be encoded within a URL

You could try URL encoding the ^ character.

share|improve this answer
Don't ever make a recommendation that should not be carried out. The questioner may take you seriously. He should contact the site owners as to their stupidity, but not drop tables. –  SamGoody Feb 24 '10 at 20:30
Jokes aside, +1 because the RFC really tells us to encode ours ^. –  Bruno Brant Feb 24 '10 at 20:37
@samgoody: Took out the what was meant to be funny part of my answer. –  Brian R. Bondy Feb 24 '10 at 21:04

Caret is neither reserved nor "unreserved", which makes it an "unsafe character" in URLs. They should never appear in URLs unencoded. From RFC2396:

2.2. Reserved Characters

   Many URI include components consisting of or delimited by, certain
   special characters.  These characters are called "reserved", since
   their usage within the URI component is limited to their reserved
   reserved purpose, then the conflicting data must be escaped before
   forming the URI.

                    "$" | ","

   particular component of the generic URI syntax; they are used as
   delimiters of the components described in Section 3.

   The set of characters actually reserved within any given URI
   reserved if the semantics of the URI changes if the character is
   replaced with its escaped US-ASCII encoding.

2.3. Unreserved Characters

   purpose are called unreserved.  These include upper and lower case

      unreserved  = alphanum | mark


   Unreserved characters can be escaped without changing the semantics

2.4. Escape Sequences

   unreserved character; this includes data that does not correspond to
   corresponds to any US-ASCII character that is disallowed, as
   explained below.
share|improve this answer
I should add that RFC 3986 supersedes 2396, but 3986 spreads the relevant information around so much that I couldn't find a good single place to cite. RFC 2396 is still mostly correct for all practical purposes, and is generally easier to understand. –  Laurence Gonsalves Feb 24 '10 at 20:29

The crawler may be using regular expressions to parse the URL and therefore is falling over because the caret (^) means beginning of line. I'm thinking these URLs are really bad practice since they are exposing the underlying database structure; whomever wrote this might want to consider serious refactoring!


share|improve this answer
No, the crawler is 4 lines of code - no parsing nothing –  Kshitij Saxena -KJ- Feb 24 '10 at 20:15

Your Answer


