url-encode.lua

local char_to_hex = function(c)
  return string.format("%%%02X", string.byte(c))
end

local function urlencode(url)
  if url == nil then
    return
  end
  url = url:gsub("\n", "\r\n")
  url = url:gsub("([^%w ])", char_to_hex)
  url = url:gsub(" ", "+")
  return url
end

local hex_to_char = function(x)
  return string.char(tonumber(x, 16))
end

local urldecode = function(url)
  if url == nil then
    return
  end
  url = url:gsub("+", " ")
  url = url:gsub("%%(%x%x)", hex_to_char)
  return url
end

-- ref: https://gist.github.com/ignisdesign/4323051
-- ref: http://stackoverflow.com/questions/20282054/how-to-urldecode-a-request-uri-string-in-lua
-- to encode table as parameters, see https://github.com/stuartpb/tvtropes-lua/blob/master/urlencode.lua

Line 10 is not the right regex for url safe characters. This code will incorrectly % encode the characters . _ - ~ even though they are already safe per https://tools.ietf.org/html/rfc3986#section-2.3. The correct one would be
str = string.gsub(str, "([^%w _ %- . ~])", char_to_hex)

you forgot to escape some patterns too bro
str = string.gsub(str, "([^%w _%%%-%.~])", char_to_hex)
If it isnt alphanumeric, a space, a % sign, a -, a . or a ~ it will decode

Thanks for the gist. URLs can also be decoded/encoded online using UrlTools.org tool.

@DanielVukelich
Which option is the most resilient. Yours or op's or by @deltanedas ?

@kqvanity I think you can just try some cases yourself. There are many preferences when doing the encoding. I opted for a conservative approach that prioritizes a broader range of characters for percent-encoding. This choice ensures compatibility across various systems and contexts, even if it means encoding characters that RFC 3986, section 2.3, lists as safe (such as ., _, -, ~).

For environments that require strict adherence to the RFC, the regex can be adjusted as suggested, to exclude these characters from encoding:
url = url:gsub("([^%w _%%%-%.~])", char_to_hex)