Does UrlDecode handle plus (+) correctly?

Question

According to RFC 2396,

The plus "+", dollar "$", and comma "," characters have been added to
those in the "reserved" set, since they are treated as reserved within the query component.

Indeed, search this site for "plus + comma , dollar $", and you get

http://stackoverflow.com/search?q=plus+%2B+comma+,+dollar+$

Plus is only encoded (by the application) when it's not being used as a delimiter.

But as others have observed, .NET's UrlDecode function converts plus to space. Where is this behavior specified?

Answer 1

Where is this behavior specified?

The HTML spec, curiously enough.

UrlDecode is kind of misleadingly named.

+ only stands for a space in application/x-www-form-urlencoded data as defined by HTML; that is, either in a form POST submission request body or in the ?query part of the URL. This is a special case! Elsewhere in the URL a plus is just a plus.

http://www.example.com/path+path/x?query+name=query+value

In this URL the parameter query name is set to query value. It might be generated by submitting this form field in a GET form:

<input name="query name" value="query value">

However, the folder name is literally path+path. No space.

Because this is confusing and potentially ambiguous, the best approach is always to encode spaces to %20. You can do that in .NET using UrlPathEncode. This works equally well in both the query part of the URL and the path.