What Is a Query String? URL Parameters Explained

A query string is the portion of a web address (URL) that appears after a question mark (?), containing key-value pairs that pass information to a website or server. When you search Google and see ?q=weather+today in the address bar, or filter products with ?color=blue&size=large, you are looking at a query string. It tells the server what to return without changing the base page path.

What It Is

A typical URL has several parts:

`

https://shop.example.com/products?category=shoes&sort=price

|_____| |_______________| |________| |___________________|

scheme host/path path ends query string starts

`

The query string begins at ? and uses these conventions:

• key=value pairs separated by &
• Spaces often encoded as + or %20
• Special characters percent-encoded (%26 for &, etc.)

The server (or client-side JavaScript) reads these parameters and adjusts content — search results, filters, pagination, language selection, tracking codes, and more.

Query strings are visible in the browser bar, bookmarkable, and shareable — unlike data sent only in POST request bodies.

Why It Matters

For users, query strings power everyday web behavior: sharing a filtered Amazon search, sending a Google Maps link with exact coordinates, or bookmarking page 3 of forum results.

For developers, query strings are a simple stateless way to pass options to server-side code (PHP, Python, Node) or front-end routers (React, Vue). They enable deep linking — URLs that open a specific app view directly.

For marketers and analysts, parameters like utm_source and utm_campaign in query strings track where traffic originated — the foundation of campaign analytics.

For security and privacy, visible parameters mean sensitive data should not appear in query strings (passwords, session tokens) because they leak via browser history, referrer headers, and server logs.

How It Works

When you visit a URL with a query string:

1. The browser sends an HTTP GET request including the full URL.

2. The web server (or framework) parses everything after ? into a parameter map.

3. Application code reads values — e.g., category=shoes → fetch shoe products.

4. The response HTML or JSON reflects those parameters.

Server-side vs. client-side

Traditional sites parse query strings on the server before rendering HTML. Single-page apps often read window.location.search or router utilities in the browser and fetch API data accordingly.

Encoding rules

URLs allow only a limited character set. encodeURIComponent() in JavaScript and equivalent libraries in other languages ensure &, =, spaces, and Unicode survive transit intact.

Multiple values

Some frameworks accept repeated keys (?tag=js&tag=web) or bracket notation (?filter[]=a&filter[]=b). Behavior varies by stack — document your convention.

Common Examples

| Scenario | Example query string |

|----------|---------------------|

| Site search | ?q=laptop+stand |

| Pagination | ?page=2 |

| E-commerce filters | ?brand=nike&price_max=100 |

| Language switch | ?lang=es |

| Analytics tracking | ?utm_source=newsletter&utm_medium=email |

| API calls (REST style) | /api/users?role=admin&limit=50 |

| Map location | ?lat=40.7128&lon=-74.0060 |

YouTube share links with ?t=90 jump to 90 seconds. GitHub issue filters use query parameters extensively.

Common Misconceptions

"Query strings and URL paths are the same thing"

The path (/products/shoes) often identifies a resource hierarchy. The query string modifies how that resource is presented or filtered. REST designers sometimes prefer paths for identifiers and queries for optional modifiers — conventions vary.

"Query strings are hidden from the server"

They are fully visible in the request line, logs, and often Referer headers when users click external links. Never put secrets there.

"POST forms never use query strings"

POST requests can include a query string on the URL while sending a body — uncommon but valid. Most form data belongs in the body, not the query, especially for large or sensitive input.

"Changing query strings always requires a page reload"

Modern JavaScript can update parameters with the History API (pushState) without full reloads — but the URL still reflects state users can bookmark.

"SEO ignores query strings entirely"

Search engines can index parameterized URLs but may treat near-duplicate parameter combinations as duplicate content. Canonical tags and parameter handling in Search Console help manage this.

The Takeaway

A query string is the ?key=value&... portion of a URL that passes instructions and options to a website. It enables search, filters, tracking, and deep links — but should not carry sensitive data because it is visible everywhere the URL goes.

Practical takeaways

If you only remember a few points from this explainer, make them these: start with the plain-English definition, then match it to a real situation you already face (a device, a website, a work task, or a household decision). Next, notice the trade-offs — speed versus control, convenience versus privacy, simplicity versus flexibility — because most technology and money terms hide a trade-off rather than a pure upgrade. Finally, verify details against an official source before you change settings, sign documents, or spend money. Definitions on the internet go stale; product screens and regulations change.

When to dig deeper

You do not need a textbook for every search query. Dig deeper when money, identity, legal rights, or account security are involved; when a tutorial asks you to disable protections; or when two reputable sources disagree. In those cases, prefer primary documentation (vendor help pages, standards bodies, government consumer pages) over viral summaries. A clear mental model plus one trusted checklist usually beats collecting ten half-read explainers.

*This article is for general informational purposes only and does not constitute professional web development advice.*