Introduction

On Android, query strings commonly appear in deep links, browser callbacks, and OAuth redirects. The safest default is to let the platform parse them through Uri, because manual string splitting tends to break on encoding, repeated keys, and malformed input.

Use Uri for Normal URLs and Deep Links

When you receive a full URL, parse it once and read its parameters through Uri methods.

1import android.net.Uri
2
3fun parseQuery(url: String): Map<String, String?> {
4    val uri = Uri.parse(url)
5    val result = mutableMapOf<String, String?>()
6
7    for (name in uri.queryParameterNames) {
8        result[name] = uri.getQueryParameter(name)
9    }
10
11    return result
12}
13
14fun main() {
15    val parsed = parseQuery("myapp://open?screen=profile&id=42")
16    println(parsed)
17}

This is clearer and more robust than splitting on & and = yourself.

Handle Repeated Parameters Intentionally

Some URLs legitimately contain the same key more than once. Analytics tags, filters, and search parameters often do this. If you call getQueryParameter, Android returns only one value. Use getQueryParameters when repetition matters.

1import android.net.Uri
2
3val uri = Uri.parse("myapp://feed?tag=android&tag=kotlin&tag=ui")
4val tags = uri.getQueryParameters("tag")
5println(tags)

If your app expects multiple values, model that requirement directly instead of silently throwing the extras away.

Parse Raw Query Text Only When Necessary

Sometimes you receive only the query fragment, not a full URL. In that case, manual parsing may be needed, but it should still be decoding-aware.

1import java.net.URLDecoder
2import java.nio.charset.StandardCharsets
3
4fun parseRawQuery(raw: String): Map<String, String> {
5    if (raw.isBlank()) return emptyMap()
6
7    return raw.split("&")
8        .mapNotNull { pair ->
9            val idx = pair.indexOf('=')
10            if (idx <= 0) return@mapNotNull null
11
12            val key = URLDecoder.decode(pair.substring(0, idx), StandardCharsets.UTF_8)
13            val value = URLDecoder.decode(pair.substring(idx + 1), StandardCharsets.UTF_8)
14            key to value
15        }
16        .toMap()
17}
18
19println(parseRawQuery("name=Ada%20Lovelace&city=London"))

This still requires a decision for malformed pairs and duplicate keys. That decision should be explicit, not accidental.

Typical Deep-Link Use in an Activity

Most Android apps parse query strings from intent.data.

1import android.os.Bundle
2import androidx.appcompat.app.AppCompatActivity
3
4class DeepLinkActivity : AppCompatActivity() {
5    override fun onCreate(savedInstanceState: Bundle?) {
6        super.onCreate(savedInstanceState)
7
8        val uri = intent?.data
9        val source = uri?.getQueryParameter("source")
10        val productId = uri?.getQueryParameter("product_id")
11
12        println("source=$source productId=$productId")
13    }
14}

Treat every parameter as optional unless your contract guarantees it. External links are untrusted input.

Validate Values After Parsing

Parsing only tells you that a string has structure. It does not prove the values are valid for your app. After reading query parameters, check types, allowed values, and expected ranges.

For example:

• parse numeric IDs safely with toLongOrNull()
• verify enum-like values against an allowed set
• reject oversized payloads in auth or analytics flows
• confirm state or nonce values before accepting login callbacks

This is where most security and routing bugs actually live.

A good production habit is to keep one shared parsing utility instead of reimplementing query handling in each activity or fragment. That keeps decoding, validation, and duplicate-key behavior consistent across deep links, OAuth callbacks, and analytics routes.

Common Pitfalls

• Manually splitting URLs when Uri parsing would be safer.
• Forgetting repeated keys and silently losing values.
• Reading percent-encoded strings without decoding them.
• Assuming a parsed parameter is trustworthy just because it exists.
• Treating malformed deep links as impossible and skipping tests.

Summary

• Use Uri APIs first for full URLs and deep links.
• Use getQueryParameters when the same key may appear multiple times.
• Parse raw query text manually only when you truly do not have a full URI.
• Validate parsed values as untrusted external input.
• Add tests for encoded values, repeated keys, and malformed links.