title: Why is this %2B string being urldecoded?
body: <p>[This may not be precisely a programming question, but it's  a puzzle that may best be answered by programmers. I tried it first on the Pro Webmasters site, to overwhelming silence]</p>
  
  <p>We have an email address verification process on our website. The site first generates an appropriate key as a string</p>
  
  <pre><code>mykey
  </code></pre>
  
  <p>It then encodes that key as a bunch of bytes</p>
  
  <pre><code>&amp;$dac~ʌ����!
  </code></pre>
  
  <p>It then base64 encodes that bunch of bytes</p>
  
  <pre><code>JiRkYWN+yoyIhIQ==
  </code></pre>
  
  <p>Since this key is going to be given as a querystring value of a URL that is to be placed in an HTML email, we need to first URLEncode it then HTMLEncode the result, giving us (there's no effect of HTMLEncoding in the example case, but I can't be bothered to rework the example)</p>
  
  <pre><code>JiRkYWN%2ByoyIhIQ%3D%3D
  </code></pre>
  
  <p>This is then embedded in HTML that is sent as part of an email, something like:</p>
  
  <pre><code>click &lt;a href="http://myapp/verify?key=JiRkYWN%2ByoyIhIQ%3D%3D"&gt;here&lt;/a&gt;. 
  Or paste &lt;b&gt;http://myapp/verify?key=JiRkYWN%2ByoyIhIQ%3D%3D&lt;/b&gt; into your browser.
  </code></pre>
  
  <p>When the receiving user clicks on the link, the site receives the request, extracts the value of the querystring 'key' parameter, base64 decodes it, decrypts it, and does the appropriate thing in terms of the site logic.</p>
  
  <p><em>However</em> on occasion we have users who report that their clicking is ineffective. One such user forwarded us the email he had been sent, and on inspection the HTML had been transformed into (to put it in terms of the example above)</p>
  
  <pre><code>click &lt;a href="http://myapp/verify?key=JiRkYWN+yoyIhIQ%3D%3D"&gt;here&lt;/a&gt;
  Or paste &lt;b&gt;http://myapp/verify?key=JiRkYWN+yoyIhIQ%3D%3D&lt;/b&gt; into your browser.
  </code></pre>
  
  <p>That is, the %2B string - but none of the other percentage encoded strings - had been converted into a plus. (It's definitely <em>leaving</em> us with the right values - I've looked at the appropriate SMTP logs).</p>
  
  <pre><code>key=JiRkYWN%2ByoyIhIQ%3D%3D
  key=JiRkYWN+yoyIhIQ%3D%3D
  </code></pre>
  
  <p>So I think that there are a couple of possibilities:</p>
  
  <ol>
  <li><p>There's something I'm doing that's stupid, that I can't see, or </p></li>
  <li><p>Some mail clients convert %2b strings to plus signs, perhaps to try to cope with the problem of people mistakenly URLEncoding plus signs </p></li>
  </ol>
  
  <p>In case of 1 - what is it? In case of 2 - is there a standard, known way of dealing with this kind of scenario?</p>
  
  <p>Many thanks for any help</p>