Fix spaces, ampersands and plus signs in FileMaker API URLs

Separate the value from the URL

If a query value contains R&D, the ampersand must travel as data. If you concatenate it directly into a query string, a server can interpret it as the start of another parameter. The same problem appears when a literal plus sign is decoded as a space.

Build the endpoint and query separators yourself, and encode each raw value at that boundary. Do not encode the complete URL, and do not encode a value that your request builder has already encoded.

Compare the raw and encoded forms

Hexadecimal letters may be upper- or lowercase. These examples are query values, not whole URLs. The receiving API still defines the parameter names, accepted text and decoding behavior.

Build a fictional search request

Let ( [
    base = "https://api.example.com/search" ;
    company = "R&D" ;
    code = "A+B"
] ;
    base & "?company=" & GetAsURLEncoded ( company )
        & "&code=" & GetAsURLEncoded ( code )
)

The intended URL is https://api.example.com/search?company=R%26D&code=A%2BB. Claris documents which characters GetAsURLEncoded leaves unchanged. It is not a universal canonical encoder for request signatures; signed APIs may specify a stricter encoding and sorting algorithm.

Set Variable [ $url ; Value: "https://api.example.com/search?company=" &
    GetAsURLEncoded ( "R&D" ) ]
Set Variable [ $options ; Value: "--request GET --connect-timeout 5 --max-time 10" ]
# Replace the reserved example endpoint with a controlled sandbox first.
# Insert from URL: target $response, dialogs Off,
# Verify SSL Certificates On, Automatically encode URL Off.
# Capture Get ( LastError ) immediately after that request.

The automatic URL-encoding option belongs to the Insert from URL step configuration. Turn it off for this already-encoded URL. Keep certificate verification enabled. Use a sandbox that echoes the decoded parameters so you can check the complete request path.

Recognize double encoding

If an already-encoded R%26D is encoded again, its percent sign can become %25, producing R%2526D. A server that decodes once sees R%26D, not R&D. That is a different search value.

Keep one variable for raw business text and a separate variable for the assembled URL. When the user changes a search, rebuild from raw text instead of modifying yesterday’s URL. Do not “fix” double encoding by decoding every value until it looks readable; an actual percent sequence may be meaningful data.

If you use Filesoft’s cURL builder, check its generated URL calculation and encoding instructions. Use one encoding path. A URL copied from a browser may already contain encoded values.

Inspect what the server received

Send the five examples to a controlled echo endpoint and compare its decoded values with the originals. Check that company and code are two parameters, that R&D remains one company value, and that A+B retains its plus sign.

Do not rely on a pretty URL shown in a browser’s address bar. Inspect the request or the sandbox response. For production troubleshooting, omit tokens and personal search values from shared logs.