bad characters in url string