The urldecode operation turns a URL-encoded value back into ordinary text. It is the reverse of urlencode.
How it works
Value: hello+world Result: hello world
Value: info%40firma.cz Result: info@firma.cz
Value: %2B420797992279 Result: +420797992279
Value: ahoj+sv%C4%9Bte+%26 Result: ahoj světe &Percent codes become the characters they stand for, + becomes a space, and anything that was not encoded is left alone.
Decoding something that was not encoded
Because unencoded characters pass through untouched, running this on ordinary text mostly does nothing. Mostly.
The exception is the plus sign. A value that genuinely contains one, such as a phone number written +420797992279, comes out as 420797992279 with a leading space. The number is now wrong and nothing about it looks unusual.
So decode only where you know the value arrived encoded. If a field is sometimes encoded and sometimes not, put a condition on the step, for example only decoding when the value contains a %.
When you need it
Values arriving in a query string. An incoming postback or webhook that carries a name or an email in the URL will have them encoded.
Reading a value back out of a link. A redirect URL from an advertiser often has parameters inside it, and those are encoded.
Checking what a value really is when something looks wrong and you suspect it was encoded twice. A value showing %2540 was encoded once too often, and decoding it once gives you %40.
Malformed input
A percent sign that is not followed by two valid hex digits is left as it is rather than causing an error. That means a half-encoded value decodes partially and quietly, so the result may be neither the original nor an obvious failure.
Reference
See PHP: urldecode and RFC 3986.
