+ is interpreted as white space in a query string, and + itself becomes %2B (see URL Encoding).

On the client side, if you use a form to submit the parameters, the browser will automatically do the encoding; if you manually code the parameters in a URL, you have to do the encoding yourself.

On the server side, the parameters will be decoded automatically by the application server so you don't need to do substring replacement (note that this is different from the special character filtering we discussed in class).