Why use urllib.parse instead of building URLs by concatenating strings?

Short answer

Because it encodes parameters correctly (spaces, &, =, and Arabic characters) and splits URL parts safely, whereas manual concatenation breaks URLs and can open vulnerabilities.

Explanation

If a user-supplied value contains & or #, manual concatenation corrupts the URL structure or injects extra parameters. urlencode builds the query string with correct encoding, and urlsplit and parse_qs take URLs apart for reading. HTTP libraries such as httpx and requests do this automatically through params=. Do not put secrets or tokens in the URL because they get recorded in logs and proxies; put them in headers.

Code example

from urllib.parse import urlencode, urlsplit, parse_qs

params = {"q": "Coffee & Tea", "page": 2}
url = "https://api.example.com/search?" + urlencode(params)
# ...search?q=%D9%82...+%26+...&page=2

parts = urlsplit(url)
print(parse_qs(parts.query)["q"])  # ['Coffee & Tea']

Common mistakes

• Building the URL with an f-string using user input directly.
• Passing an API key in the query string instead of a header.

Follow-up questions

• What are the basic rules for using an HTTP client in Python?

Sources

• Python documentation — urllib.parse