# Bad value X for attribute “href” on element “a”: Illegal character in scheme data: space is not allowed.

> Canonical HTML version: https://rocketvalidator.com/html-validation/bad-value-x-for-attribute-href-on-element-a-illegal-character-in-scheme-data-space-is-not-allowed
> Attribution: Rocket Validator (https://rocketvalidator.com)
> License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)

The URL standard (defined by WHATWG) specifies a strict set of characters allowed in each part of a URL. A space character is not among them. When the validator encounters a literal space in an `href` value, it reports the error "Illegal character in scheme data: space is not allowed." This applies to spaces anywhere in the URL — the path, query string, fragment, or even after the scheme (e.g., `https:`).

While most modern browsers are forgiving and will attempt to fix malformed URLs by encoding spaces automatically, relying on this behavior is problematic for several reasons:

- **Standards compliance:** Invalid URLs violate the HTML specification, and markup that depends on browser error-correction is fragile and unpredictable.
- **Accessibility:** Assistive technologies, such as screen readers, may not handle malformed URLs the same way browsers do. This can result in broken links for users relying on these tools.
- **Interoperability:** Non-browser consumers of your HTML — search engine crawlers, link checkers, email clients, RSS readers, and APIs — may not perform the same auto-correction, leading to broken links or missed content.
- **Copy-paste and sharing:** When users copy a malformed URL from the source, the space can cause the link to break when pasted into other applications.

## How to fix it

The fix depends on where the space appears:

1. **In the path or fragment:** Replace each space with `%20`. For example, `/my file.html` becomes `/my%20file.html`.
2. **In the query string:** You can use `%20` or, if the value is part of `application/x-www-form-urlencoded` data, `+` is also acceptable for spaces within query parameter values. However, `%20` is universally safe.
3. **Programmatically:** Use `encodeURI()` in JavaScript to encode a full URL (it preserves structural characters like `/`, `?`, and `#`). Use `encodeURIComponent()` to encode individual query parameter values. On the server side, use your language's equivalent URL-encoding function.

If you're writing URLs by hand in HTML, simply find every space and replace it with `%20`. If URLs are generated dynamically (from a database, CMS, or user input), ensure your templating or server-side code encodes them before inserting into the markup.

## Examples

### Invalid — space in the path

```html
<a href="https://example.com/docs/My Report.pdf">Download Report</a>
```

The literal space between "My" and "Report" triggers the validator error.

### Fixed — space encoded as `%20`

```html
<a href="https://example.com/docs/My%20Report.pdf">Download Report</a>
```

### Invalid — space in a query parameter

```html
<a href="https://example.com/search?q=hello world">Search</a>
```

### Fixed — space encoded in the query string

```html
<a href="https://example.com/search?q=hello%20world">Search</a>
```

### Invalid — multiple spaces in different URL parts

```html
<a href="https://example.com/my folder/page two.html?ref=some value#my section">Link</a>
```

### Fixed — all spaces encoded

```html
<a href="https://example.com/my%20folder/page%20two.html?ref=some%20value#my%20section">Link</a>
```

### Encoding URLs with JavaScript

If you're building URLs dynamically, use the built-in encoding functions rather than doing manual string replacement:

```html
<script>
  // encodeURI encodes a full URL but preserves :, /, ?, #, etc.
  const url = encodeURI("https://example.com/docs/My Report.pdf");
  // Result: "https://example.com/docs/My%20Report.pdf"

  // encodeURIComponent encodes a single value (for query params)
  const query = encodeURIComponent("hello world");
  // Result: "hello%20world"
</script>
```

Note that `encodeURI()` is appropriate for encoding a complete URL, while `encodeURIComponent()` should be used for individual components like query parameter values — it encodes characters such as `/` and `?` that have structural meaning in a URL.