Escaping (ampersand) in browsable API URLs.

[modernNeo]

I think this issue has come back: #1649

Copy-pasting my comment on that issue here since I am an unsure if anyone got notified about an issue from so far back:

Django==3.2.20
djangorestframework==3.14.0

and I am seeing this load for the next url

<a href="http://127.0.0.1:8000/user_points/?page=2%C3%97tamp%3D5" rel="nofollow"><span class="str">http://127.0.0.1:8000/user_points/?page=2&amp;timestamp=5</span></a>

[browniebroke]

Have you tried with the latest Django and DRF?

[modernNeo]

as I suspected, issue persists with the following modules

Django==5.1.5
djangorestframework==3.15.2

[NikeGunn]

Issue Analysis and Solution: Malformed Pagination URL in DRF 3.14.0

📝 Summary

It appears that issue #1649 has resurfaced in recent DRF versions.

Environment Details
Django version	3.2.20
DRF version	3.14.0

Problem Observed

When pagination is applied, the generated URL is incorrectly encoded:

✅ Expected URL:

http://127.0.0.1:8000/user_points/?page=2&timestamp=5

❌ Actual URL:

http://127.0.0.1:8000/user_points/?page=2%C3%97tamp%3D5

The %C3%97 represents a Unicode multiplication sign (×) instead of an ampersand (&), breaking the query string structure.

🔍 Root Cause

DRF's pagination classes appear to be mishandling query parameter encoding, potentially inserting unexpected characters during the generation of next/previous links.

Proper link construction should leverage urllib.parse or Django's QueryDict to ensure correct URL escaping and encoding.

💡 Recommendation for DRF Maintainers

• Pagination classes should implement proper encoding of query parameters using urlencode
• Manual string manipulation for URL construction should be avoided
• This would prevent Unicode substitution issues and ensure safe URL construction

⚙️ Temporary Workaround

Until this issue is resolved, you can implement a custom pagination class:

from rest_framework.pagination import PageNumberPagination
from urllib.parse import urlencode

class SafePageNumberPagination(PageNumberPagination):
    def get_next_link(self):
        if not self.page.has_next():
            return None
        query_params = self.request.query_params.copy()
        query_params[self.page_query_param] = self.page.next_page_number()
        return f"{self.request.path}?{urlencode(query_params)}"

    def get_previous_link(self):
        if not self.page.has_previous():
            return None
        query_params = self.request.query_params.copy()
        query_params[self.page_query_param] = self.page.previous_page_number()
        return f"{self.request.path}?{urlencode(query_params)}"