Developer

How Query Strings Help Tracking and Redirects

Published March 8, 2026 · Updated March 15, 2026 · 3 min read

Query strings carry information that changes how a server responds or how analytics tools attribute traffic. Two of the most common uses — tracking parameters and redirect destinations — are also two of the most common sources of broken URLs when encoding goes wrong.

UTM parameters

UTM parameters are the standard for tagging traffic sources in Google Analytics and most other analytics platforms. The five standard parameters:

utm_source — where the traffic came from (newsletter, twitter, google)
utm_medium — the channel type (email, cpc, social)
utm_campaign — the campaign name
utm_term — the keyword (for paid search)
utm_content — distinguishes between ads in the same campaign

https://veratools.io/?utm_source=newsletter&utm_medium=email&utm_campaign=march-2026

Campaign names with spaces need encoding: utm_campaign=spring%20sale, not utm_campaign=spring sale. The space in the unencoded version may be interpreted as the end of the parameter by some systems.

Redirect destination encoding

A redirect URL passed as a query parameter must be fully percent-encoded, because it contains characters that have structural meaning in URLs:

# Broken — the inner ? and & break the outer URL structure
/login?next=/dashboard?tab=settings&view=list

# Correct — the inner URL is encoded
/login?next=%2Fdashboard%3Ftab%3Dsettings%26view%3Dlist

Without encoding, the outer URL parser reads the &view=list as a second parameter named view with value list, losing it from the redirect destination. After login, the user lands at /dashboard?tab=settings instead of the intended URL.

Security note: never redirect to an arbitrary URL from a query parameter without validating it against an allowlist of your own domains. An open redirect vulnerability lets attackers craft links that appear to go to your trusted site but send users to a phishing page after login.

Affiliate and campaign codes

Affiliate platforms append their own tracking parameters to your destination URLs. The result can be URLs with 15+ parameters. When these are manually assembled — copied between spreadsheets, appended by marketing tools — encoding errors are common. A query string parser shows exactly how each parameter will be decoded by the receiving server, which is useful for verifying a complex tracking URL before it goes into a campaign.