The unescaping that we've been arguing about is %xx to ASCII.
Escaping is done _by_the_client_ if keywords/form fields contain
characters that are illegal (or otherwise would cause confusion)
in URLs, %xx escapes are used. Clearly the escaping scheme has
to be well known between browser and server, because this escaping
is done in the part of the URL that is composed _by_the_client_
(so it is bound to be non-opaque to it).
These will be unescaped either by server or the script; both of
them know how to do it. The problem was that there are other
reserved characters than just +&= and if they are left unparsed
by server, but %xx are still unescaped, the result may
contain characters that have a special meaning in URL, but
the script cannot tell anymore if those stand for their special
meaning, or if they were escaped in the first place.
-- Cheers, Ari --