On: Ask PG: Why are apostrophes filtered out of URLs?

like foo.com'onclick="alert('hi');"

But yeah the right way to do this is to use a well-tested urlencoding library, not to strip out dangerous-looking characters.