As I have already responded to your question on WinSCP forum:
That's how URLs work. Even the Wikipedia article that you yourself point to (well, I've pointed you to that article), explains that. It does not matter, if it is http://
URL, sftp://
URL or ftp://
URL. It's still URL.
For example, how else would you tell, if in the following URL, the username is user
and password bar:blah
or that user is foo:bar
and password is blah
?
sftp://foo:bar:blah@host
All SFTP/FTP software that I know that use URLs do the same. As you can see on the example above, they actually have to. That includes OpenSSH, curl, wget, to name few.
OpenSSH does not use URL-encoding in the frequently used non-URL syntax user@host
. Also, their situation is easier because they do not support providing password on a command line. Hostnames cannot contain many special characters. Usernames do not contain them often either. So for example even, if the username contains @
sign, the syntax user@domain@host
can still be parsed, as host
cannot contain @
so it's clear that user@domain
is the username. But even in their limited use, you might face situation in which the syntax is ambiguous. That happens when the syntax contains at least two components that can contain special characters. With OpenSSH that can happen if you include both username and path. For example:
sftp username/domain@host:/path@foo
How would you parse that? There's no unambiguous way to decide what is a username, what is a hostname, and what is a path to the file to download. That's when you will want to use proper URL syntax with percent encoding:
sftp sftp://username%2Fdomain@host/path%40foo
Also WinSCP's URL syntax is incomparably more powerful than that of OpenSSH. WinSCP URL can contain username, password, path and even more. All of these can contain special characters. So WinSCP must be even more strict when parsing an URL.
As with OpenSSH, other software also supports alternative syntax to provide the connection info than URL, if you do not want to mess with the URL-encoding. That's true for wget, curl, and WinSCP. In WinSCP, there are -username
and -password
switches for that.