Is there any formal restriction as to which characters are allowed in URL parameter names?
I've been reading RFC3986 ("Uniform Resource Identifier (URI): Generic Syntax") but came to no definitive conclusion.
I know there are practical limitations, but would it actually be forbidden to do something like:
param with\funny<chars>=some_value
as long as I escape it correctly:
param%20with%1cfunny%3cchars%3e=some_value
There are no restrictions on escaped parameter names in the URI specs. There might be restrictions in the server-side software that you use, though. This is especially true if you use “homemade” scripts to interpret URIs.