Double encoding

Double encoding is an attack technique used to bypass security mechanisms which only decode data once. It can be used to masquerade a directory traversal attack or a cross-site scripting (XSS) attack. Most double encoding works by encoding the character(s) you want to put in, so that it really decodes the message to input illegal characters.
codice_1 URI encoded becomes codice_2. Double URI encoded it becomes codice_3.
Example.
encodeURIComponent(encodeURIComponent("/etc/passwd")) // --> "%252Fetc%252Fpasswd"
decodeURIComponent("%252Fetc%252Fpasswd") // --> "%2Fetc%2Fpasswd"
PHP.
 GET /download.php?file=%252Fetc%252Fpasswd
urldecode($_GET["file"]); // --> "%2Fetc%2Fpasswd"