Special characters like @ and & in cURL POST data

Question

How do I include special characters like @ and & in the cURL POST data? I'm trying to pass a name and password like:

curl -d name=john passwd=@31&3*J https://www.mysite.com

This would cause problems as @ is used for loading files and & for specifying more than one key/value. Is there some way I can escape these characters? \@ and \& don't seem to work.

score 88 · Accepted Answer · edited Jun 16 '23 at 10:44

88

cURL > 7.18.0 has an option --data-urlencode which solves this problem. Using this, I can simply send a POST request as

curl -d name=john --data-urlencode passwd=@31&3*J https://www.example.com

Summarizing the comments, in case of mixed "good" and "bad" data and exclamation marks inside we can use on Windows:

curl -d "grant_type=client_credentials&client_id=super-client&acr_values=tenant:TNT123" --data-urlencode "client_secret=XxYyZ21D8E&%fhB6kq^mXQDovSZ%Q*!ipINme" https://login.example.com/connect/token

edited Jun 16 '23 at 10:44

Benjamin Loison

3,782
4
16
33

answered Apr 23 '12 at 11:07

Bernhard Heijstek

2,041
1
16
20

1

I have 7.52.1 and I can't get this to work... I can do --data-urlencode "something=it's a test" but not with double quotes or @ symbols... – PJ Brunet Jan 20 '18 at 04:09
1

Remember to use `--data-urlencode` only for the data part that needs it. For example, the following will not work when you combine the data into one entity: `curl --data-urlencode "name=john&passwd=@31&3*J" https://www.example.com` – Mr-IDE Apr 27 '18 at 10:08
2

Exclamation points seem to cause problems with this in regards to history expansion in bash. You can fix it with single quotes around each piece of data (e.g. `--data-urlencode 'password=abc!123'` or by escaping the exclamation `--data-urlencode password=abc\!123`. More info: https://unix.stackexchange.com/questions/33339/cant-use-exclamation-mark-in-bash – 2xj Apr 01 '19 at 18:28

score 45 · Answer 2 · answered Apr 08 '12 at 03:17

45

How about using the entity codes...

@ = %40

& = %26

So, you would have:

curl -d 'name=john&passwd=%4031%263*J' https://www.mysite.com

answered Apr 08 '12 at 03:17

Biagio Arobba

1,075
11
27

Could you please be kind enough to specify entity code for "+" – Kasun Siyambalapitiya May 01 '18 at 12:08
did you figure out the '+' part for this? – shreyas K N Sep 20 '18 at 06:06
I wanted to replace name=john&passwd=%4031%263*J with an variable, but couldn't. Any help? – Bharath Kumar Jun 22 '20 at 12:50
@KasunSiyambalapitiya '+' is '%2B'. You can use https://www.urlencoder.io/ if you'd like to encode any character. – bdrnglm Jun 06 '23 at 08:48
works only on formurlencoded buyt does not work on json post data. – e-info128 Jun 22 '23 at 23:52

score 16 · Answer 3 · edited Jun 16 '23 at 10:45

16

Double quote (" ") the entire URL. It works.

curl "http://www.example.com?name=john&passwd=@31&3*J"

edited Jun 16 '23 at 10:45

Benjamin Loison

3,782
4
16
33

answered Mar 04 '14 at 10:37

Thusitha Sumanadasa

1,669
2
22
30

9

The request is supposed to be a POST, not a GET. – Yngvar Kristiansen Mar 05 '15 at 13:39

score 13 · Answer 4 · answered Sep 13 '17 at 13:47

13

Just found another solutions worked for me. You can use '\' sign before your one special.

passwd=\@31\&3*J

answered Sep 13 '17 at 13:47

user3650655

361
3
8

score 7 · Answer 5 · edited Jun 16 '23 at 10:46

7

If password has the special characters in it, just round the password with the single quote it will work.

curl -u username:'this|!Pa&*12' --request POST https://www.example.com

edited Jun 16 '23 at 10:46

Benjamin Loison

3,782
4
16
33

answered Apr 30 '21 at 00:28

Abdul Majeed

2,671
22
26

1

This worked for me for a password that had a double quote (`"`) in it. – T. Thomas Jun 16 '21 at 22:17
the same can be done with username: `curl -u 'weird|user!':'this|!Pa&*12' --request POST https://www.example.com` – Robot Monk Feb 15 '23 at 10:14

score 5 · Answer 6 · edited Jun 16 '23 at 10:46

5

Try this:

export CURLNAME="john:@31&3*J"
curl -d -u "${CURLNAME}" https://www.example.com

edited Jun 16 '23 at 10:46

Benjamin Loison

3,782
4
16
33

answered Feb 17 '15 at 10:39

AGOUDJIL Massinissa

59
1
1

4

Does not work if the exclamation point ("!") is one of the special characters. – Thane Plummer Oct 07 '16 at 02:49

score 0 · Answer 7 · edited Mar 20 '14 at 06:07

0

I did this

~]$ export A=g

~]$ export B=!

~]$ export C=nger


   curl http://<>USERNAME<>1:$A$B$C@<>URL<>/<>PATH<>/

edited Mar 20 '14 at 06:07

Thusitha Sumanadasa

1,669
2
22
30

answered Nov 19 '13 at 09:36

Lordlebu

411
1
6
15

Special characters like @ and & in cURL POST data

7 Answers7

Linked