How to Fix Double URL Encoding in UTM Parameters: Complete Recovery Guide

// Paste into browser console with your campaign name from Analytics
const campaignName = 'summer%2520sale';  // From GA4
 
// Test: Decode once
const decoded1 = decodeURIComponent(campaignName);
console.log('Decode 1x:', decoded1);
 
// Test: Decode twice
const decoded2 = decodeURIComponent(decoded1);
console.log('Decode 2x:', decoded2);
 
// If decoded1 ≠ decoded2, you have double-encoding
if (decoded1 !== decoded2) {
  console.log('✓ CONFIRMED: Double-encoding detected');
  console.log('Original was:', decoded2);
} else {
  console.log('Not double-encoded');
}

// JavaScript to analyze exported CSV
function analyzeDoubleEncoding(campaigns) {
  const results = {
    doubleEncoded: [],
    singleEncoded: [],
    clean: []
  };
 
  campaigns.forEach(row => {
    const name = row.campaign;
 
    if (!name.includes('%')) {
      results.clean.push(row);
      return;
    }
 
    // Test for double-encoding
    try {
      const decoded1 = decodeURIComponent(name);
      const decoded2 = decodeURIComponent(decoded1);
 
      if (decoded1 !== decoded2) {
        results.doubleEncoded.push({
          ...row,
          encoded: name,
          decoded1,
          decoded2
        });
      } else {
        results.singleEncoded.push(row);
      }
    } catch (e) {
      // Malformed encoding
      results.doubleEncoded.push({
        ...row,
        error: e.message
      });
    }
  });
 
  return results;
}

function fixDoubleEncodedURL(url) {
  try {
    const urlObj = new URL(url);
    const fixes = [];
 
    ['utm_source', 'utm_medium', 'utm_campaign', 'utm_content', 'utm_term'].forEach(param => {
      const original = urlObj.searchParams.get(param);
      if (!original) return;
 
      // Multi-level decode (handles double, triple, etc.)
      let decoded = original;
      let iterations = 0;
      const maxIterations = 10;  // Safety limit
 
      while (iterations < maxIterations) {
        try {
          const previousDecoded = decoded;
          decoded = decodeURIComponent(decoded);
 
          // Stop if no change (fully decoded)
          if (decoded === previousDecoded) break;
 
          // Stop if no more % characters
          if (!decoded.includes('%')) break;
 
          iterations++;
        } catch (e) {
          // Decoding failed, we're done
          break;
        }
      }
 
      // Clean to safe characters
      const cleaned = decoded
        .toLowerCase()
        .trim()
        .replace(/\s+/g, '-')
        .replace(/[^a-z0-9-_]/g, '')
        .replace(/-+/g, '-')
        .replace(/^-|-$/g, '');
 
      if (cleaned !== original) {
        fixes.push({
          param,
          original,
          decoded,
          cleaned,
          iterations
        });
 
        urlObj.searchParams.set(param, cleaned);
      }
    });
 
    return {
      originalURL: url,
      fixedURL: urlObj.toString(),
      changes: fixes,
      success: true
    };
 
  } catch (e) {
    return {
      originalURL: url,
      error: e.message,
      success: false
    };
  }
}
 
// Usage
const broken = 'https://example.com?utm_campaign=summer%2520sale%2526special';
const result = fixDoubleEncodedURL(broken);
 
console.log('Original:', result.originalURL);
console.log('Fixed:', result.fixedURL);
console.log('Changes:');
result.changes.forEach(change => {
  console.log(`  ${change.param}:`);
  console.log(`    Original: ${change.original}`);
  console.log(`    Decoded: ${change.decoded} (${change.iterations} iterations)`);
  console.log(`    Cleaned: ${change.cleaned}`);
});
 
// Output:
// Original: https://example.com?utm_campaign=summer%2520sale%2526special
// Fixed: https://example.com?utm_campaign=summer-sale-and-special
// Changes:
//   utm_campaign:
//     Original: summer%2520sale%2526special
//     Decoded: summer sale & special (2 iterations)
//     Cleaned: summer-sale-and-special

async function batchFixDoubleEncoding(platforms) {
  const report = {
    totalCampaigns: 0,
    fixed: 0,
    failed: 0,
    details: []
  };
 
  for (const platform of platforms) {
    console.log(`\nProcessing ${platform.name}...`);
 
    const campaigns = await platform.getCampaigns();
    report.totalCampaigns += campaigns.length;
 
    for (const campaign of campaigns) {
      try {
        const url = campaign.trackingURL;
 
        // Check if double-encoded
        if (!url.includes('%25')) {
          console.log(`  ${campaign.id}: OK (not double-encoded)`);
          continue;
        }
 
        // Fix the URL
        const fixed = fixDoubleEncodedURL(url);
 
        if (!fixed.success) {
          report.failed++;
          report.details.push({
            platform: platform.name,
            campaign: campaign.id,
            status: 'FAILED',
            error: fixed.error
          });
          continue;
        }
 
        // Update the campaign
        await platform.updateCampaign(campaign.id, {
          trackingURL: fixed.fixedURL
        });
 
        report.fixed++;
        report.details.push({
          platform: platform.name,
          campaign: campaign.id,
          status: 'FIXED',
          changes: fixed.changes
        });
 
        console.log(`  ${campaign.id}: FIXED`);
 
      } catch (e) {
        report.failed++;
        report.details.push({
          platform: platform.name,
          campaign: campaign.id,
          status: 'ERROR',
          error: e.message
        });
        console.error(`  ${campaign.id}: ERROR - ${e.message}`);
      }
    }
  }
 
  return report;
}
 
// Example platform adapter
const mailchimpAdapter = {
  name: 'Mailchimp',
  async getCampaigns() {
    // Fetch campaigns from Mailchimp API
    return mailchimp.campaigns.list();
  },
  async updateCampaign(id, updates) {
    // Update campaign tracking URL
    return mailchimp.campaigns.update(id, updates);
  }
};
 
// Run batch fix
const platforms = [mailchimpAdapter, hubspotAdapter, googleAdsAdapter];
const report = await batchFixDoubleEncoding(platforms);
 
console.log('\n=== BATCH FIX COMPLETE ===');
console.log(`Total campaigns: ${report.totalCampaigns}`);
console.log(`Fixed: ${report.fixed}`);
console.log(`Failed: ${report.failed}`);

-- Create cleaned campaigns view
CREATE OR REPLACE VIEW `project.dataset.cleaned_campaigns` AS
WITH decoded_campaigns AS (
  SELECT
    event_date,
    user_pseudo_id,
    (SELECT value.string_value FROM UNNEST(event_params) WHERE key = 'campaign') as raw_campaign,
    -- Custom decoding function (requires UDF)
    decode_url_multiple(
      (SELECT value.string_value FROM UNNEST(event_params) WHERE key = 'campaign')
    ) as decoded_campaign
  FROM `project.dataset.events_*`
  WHERE _TABLE_SUFFIX BETWEEN '20240101' AND '20241231'
)
SELECT
  event_date,
  user_pseudo_id,
  raw_campaign,
  decoded_campaign,
  -- Clean the decoded campaign
  LOWER(
    REGEXP_REPLACE(
      REGEXP_REPLACE(
        REGEXP_REPLACE(decoded_campaign, r'\s+', '-'),  -- Spaces to hyphens
        r'[^a-z0-9-_]', ''  -- Remove non-safe chars
      ),
      r'-+', '-'  -- Dedupe hyphens
    )
  ) as cleaned_campaign
FROM decoded_campaigns;

CREATE TEMP FUNCTION decode_url_multiple(input STRING)
RETURNS STRING
LANGUAGE js AS """
  let decoded = input;
  let previous;
  let iterations = 0;
 
  while (iterations < 10) {
    previous = decoded;
    try {
      decoded = decodeURIComponent(decoded);
    } catch (e) {
      break;
    }
 
    if (decoded === previous || !decoded.includes('%')) {
      break;
    }
 
    iterations++;
  }
 
  return decoded;
""";

# Double-Encoding Incident Report
 
## Discovery
- Date: 2024-11-15
- Reporter: Sarah Johnson
- Affected campaigns: 23
- Affected sessions: 12,456
- Revenue impacted: $34,567
 
## Root Cause
URL builder passed already-encoded values to email platform,
which encoded them again before sending.
 
## Timeline
- 2024-10-01: Issue began (deployment of new URL builder)
- 2024-11-15: Issue discovered
- 2024-11-15 10:00: Campaigns paused
- 2024-11-15 11:30: Fix deployed
- 2024-11-15 13:00: Campaigns reactivated
- 2024-11-15 14:00: Validation complete
 
## Fix Applied
1. Updated URL builder to use clean values only
2. Added validation to reject any URL with %
3. Updated all email templates
4. Retrained marketing team
5. Implemented pre-send validation
 
## Prevention
- [x] URL builder fixed
- [x] Validation added
- [x] Templates updated
- [x] Team trained
- [x] Documentation updated
- [x] Weekly audits scheduled
 
## Lessons Learned
- Never encode before passing to systems
- Always validate URLs before launch
- Monitor analytics for encoding artifacts
- Test end-to-end workflows

async function validateAllFixed(platforms) {
  const validation = {
    passed: 0,
    failed: 0,
    issues: []
  };
 
  for (const platform of platforms) {
    const campaigns = await platform.getCampaigns();
 
    for (const campaign of campaigns) {
      const url = campaign.trackingURL;
 
      // Check for remaining double-encoding
      if (url.includes('%25')) {
        validation.failed++;
        validation.issues.push({
          platform: platform.name,
          campaign: campaign.id,
          url,
          issue: 'Still contains %25 (double-encoded)'
        });
      } else {
        validation.passed++;
      }
    }
  }
 
  return validation;
}
 
// Run validation
const validation = await validateAllFixed(platforms);
 
if (validation.failed > 0) {
  console.error(`❌ ${validation.failed} campaigns still have issues:`);
  validation.issues.forEach(issue => {
    console.error(`  ${issue.platform} - ${issue.campaign}: ${issue.issue}`);
  });
} else {
  console.log(`✅ All ${validation.passed} campaigns validated successfully`);
}