diff --git a/api/resolvers/item.js b/api/resolvers/item.js
index 1c04587d..7c845ef6 100644
--- a/api/resolvers/item.js
+++ b/api/resolvers/item.js
@@ -552,17 +552,25 @@ export default {
     },
     dupes: async (parent, { url }, { me, models }) => {
       const urlObj = new URL(ensureProtocol(url))
-      let uri = urlObj.hostname + '(:[0-9]+)?' + urlObj.pathname
-      uri = uri.endsWith('/') ? uri.slice(0, -1) : uri
+      let { hostname, pathname } = urlObj
 
+      hostname = hostname + '(:[0-9]+)?'
       const parseResult = parse(urlObj.hostname)
       if (parseResult?.subdomain?.length) {
         const { subdomain } = parseResult
-        uri = uri.replace(subdomain, '(%)?')
+        hostname = hostname.replace(subdomain, '(%)?')
       } else {
-        uri = `(%.)?${uri}`
+        hostname = `(%.)?${hostname}`
       }
 
+      // escape postgres regex meta characters
+      pathname = pathname.replace(/\+/g, '\\+')
+      pathname = pathname.replace(/%/g, '\\%')
+      pathname = pathname.replace(/_/g, '\\_')
+
+      let uri = hostname + pathname
+      uri = uri.endsWith('/') ? uri.slice(0, -1) : uri
+
       let similar = `(http(s)?://)?${uri}/?`
       const whitelist = ['news.ycombinator.com/item', 'bitcointalk.org/index.php']
       const youtube = ['www.youtube.com', 'youtube.com', 'm.youtube.com', 'youtu.be']