URL encoding
Use percent encoding for individual URL path segments and query values. encodeURIComponent protects reserved separators inside a value, while URL APIs are usually better for assembling a complete URL.
Base64 is transport encoding, not encryption
Base64 represents bytes with printable characters. Anyone can decode it, so it provides no secrecy. Use it for binary-to-text transport only when the surrounding protocol expects it.
HTML entities protect text contexts
Encode ampersands and angle brackets before placing untrusted text into HTML. Context matters: HTML text, attributes, URLs, CSS and JavaScript each need appropriate handling, so prefer framework escaping over manual string assembly.
Read the specification
Put the guide into practice
Open the related browser tools and test the workflow with a synthetic sample