Unescape URL (percent) encoding in C

unescape.c

// convert a hexadecimal digit from 0 to f to its decimal counterpart
int hex_to_int(char hexChar) {
    if (hexChar >= '0' && hexChar <= '9') {
        return hexChar - '0';
    } else if (hexChar >= 'a' && hexChar <= 'f') {
        return hexChar - 'a' + 10;
    }
    
    return -1;
}

// Unescapes url encoding: e.g. %20 becomes a space
// Changes are made in place
void unescape_input(char *input) {
    size_t length = strlen(input);
    
    for (size_t i = 0; i < length; ++i) {
        if (input[i] == '%' && i < length - 2) {
            int high = hex_to_int(input[i + 1]) * 16;
            int low = hex_to_int(input[i + 2]);
            
            // if either high or low is -1, it means our conversion failed
            // (i.e. one of the digits was not hexadecimal
            if (high >= 0 && low >= 0) {
                input[i] = (char) (high + low);
                
                // pull characters to fill the 'empty' space
                for (size_t j = i + 3; j < length; ++j) {
                    input[j - 2] = input[j];
                }
                
                // two characters were removed from the string, so we shorten the length
                input[length - 2] = '\0';
                input[length - 1] = '\0';
                length -= 2;
            }
        }
    }
}