php - Escaping get parameters in smarty -

i have inherited code base php, mysql , smarty , i'm implementing menu system web application.

i have url such: http://example.com/?url=some/page

in database store string 'some/page' , map file 'some/path/dir/mypage.php' , when visiting url file included using include() in php script fetches url parameter.

the code contains forms uses parameters post data , if i'm on page such http://example.com/?url=myform/add need include hidden input field name url value myform/add form can post results correct page.

smarty has syntax {$smarty.get.url}that fetches url parameter , outputs it. leads hidden input field looking this:

<input type="hidden" name="url" value="{$smarty.get.url}">

now, realise should clean url parameter before printing value i'm not sure how. using {$smarty.get.url|escape:'url'} escapes / character %2f resulting in:

<input type="hidden" name="url" value="myform%2fadd">

and when submit form converted %252f giving me url:

http://example.com/?url=some%252fpage

since / supposed valid query parameter don't see why encoded @ in first place. using / in query important me allow users understand url in better way clean url's.

so question becomes, how should handle parameter in smarty keep / while @ same time protecting xss-attacks?

i'm not worried php-side of things since have protection after reading $_get['url'].

edit: perhaps don't have escape @ since php script gets url parameter , if parameter doesn't match stored in database, form never loaded , parameter never printed in hidden input field. still think question relevant other uses though.