Build an API query string without breaking spaces and ampersands

A supplier search for pump & valve becomes two query parameters when the value is concatenated directly into a URL. This can look like an upstream search bug even though the request is already wrong before it leaves your application.

Let the encoder handle values

<?php
$query = http_build_query(
    ['q' => 'pump & valve', 'page' => 2],
    '', '&', PHP_QUERY_RFC3986
);
assert($query === 'q=pump%20%26%20valve&page=2');

Pass unencoded values into the encoder. Encoding a value first and then calling http_build_query can encode the percent sign again. Log a redacted version of the final request URL while debugging so you can compare what you intended with what the server received.

Arrays and signatures need a contract

Nested arrays produce bracketed parameter names. Some APIs instead expect repeated keys or a comma-separated list. Neither format should be guessed from a PHP array alone; follow the provider's request specification.

Signed APIs may require a particular parameter order and space encoding. RFC 3986 encoding is a deliberate choice here, not a universal signature recipe. Build the canonical string exactly as the provider defines it and sign the same bytes you send.

Test an ampersand, plus sign, slash, Unicode search text, an empty string, and an omitted optional filter. Null values may be omitted by the encoder, so do not use null if the remote API requires an explicitly empty parameter. Keep credentials out of diagnostic URLs and exception messages.

Reference

Official documentation. The examples here illustrate the stated boundary; adapt them to your application and test its failure paths.