Lighttpd

Here's how lighttpd logs a request where the requested URL contains a double quote:

213.113.99.151 - - [22/Nov/2006:02:35:02 +0100] "GET /test"monkey HTTP/1.1" 404 ...

Here's a similar request to an apache 1.3.33 server:

213.113.99.151 - - [22/Nov/2006:02:36:14 +0100] "GET /test\"monkey HTTP/1.1" 404 ...

As double quotes are used to signal the beginning and ending of some fields, they should definately be escaped whenever they appear inside these fields.

This is one situation that I've come across recently (trying to parse apache log lines; it's really a horrible format, from this perspective). Perhaps there are other fields in which some characters should be escaped. Whether apache handles such cases or not is beyond my knowledge.