Sometimes we need to construct URLs out of strings built up by our own code. An important part of that is making sure to escape each component correctly.
Now for an easy life, you could use KSURLComponents to handle the workload for you. But if you want to do it manually, it's vitally important to remember that what needs escaping differs slightly from component to component (see What every web developer must know about URL encoding for a good writeup on this).
As a naïve implementation, you could do this:
BUT PLEASE DON'T.
This is fundamentally broken. If the path happens to contain a ; or ? character, they won't be escaped (as they are perfectly valid to appear somewhere in a URL). This will lead to the path effectively being cut off at that character, and anything after that point treated as the parameter string or query.
Instead, this more complex code is what you want:
Specifying # as one of the characters to escape isn't actually needed right now, CFURLCreateStringByAddingPercentEscapes goes ahead and escapes it anyway. But I'm not sure I trust that to always be the case, so seems best to be safer than sorry!
Also, you might consider specifying that colons be escaped too if there's any risk of that causing confusion (say, by generating a URL string that consists solely of a path and no scheme).
The components of a path are separated by slashes. If for some particularly esoteric reason a component might need to contain a slash of its own, that needs to be requested of Core Foundation too, encoding them as %2F.