According to RFC 1738, the following are considered unsafe:
- <and> are separators around URLs in free text
- "(double quote) - limits URLs on some systems
- restricts the URL from the fragment / anchor identifier that can follow it
- % - used to indicate character encodings
Common unsafe characters: {} | \ ^ ~ [] `
Edit:
Not a duplicate, but includes some thoughts on validation in Java: URL validation in java
source share