I recently found a URL-encoded string that was included in the middle of a POST after being delivered, in encoded form, as a hidden field inside of an HTML <form>.

The browsers were URL encoding the whole POST so that the result was encoded twice.

%253F, %253D

entries galore. But they seemed to work as expected at the other end. What scares me is that it may not be intended but is the result of reflexive application of canned URL encoding.

-- 
--> From the U S of A, the only socialist country that refuses to admit it. <--