title: Request Parameter Losing Plus Sign
body: <p>I am editing a search form and trying to protect against special characters in the database. In the JSP search form, a (multiselect) dropdown allows users to select descriptions that will be used in the query (note: descriptions is a list of strings):</p>
  
  <pre><code>&lt;select id="descriptionSelect" multiple="multiple"&gt;
      &lt;c:forEach items="${descriptions}" var="description"&gt;
          &lt;option value="${fn:escapeXml(description)}")}"&gt;                            
              &lt;c:out value="${description}" /&gt;
          &lt;/option&gt;
      &lt;/c:forEach&gt;
  &lt;/select&gt;
  </code></pre>
  
  <p>When the form submits, the page dynamically generates the URL which takes query parameters in the URL (ugly, I know, hands are tied). Here's the snipet making the description segment.</p>
  
  <pre><code>var descriptionSelectBox = document.getElementById("descriptionSelect");
  var descriptionsUrlAddition = "";
  
  for (var i = 0; i &lt; descriptionSelectBox.options.length; i++) {
      if (descriptionSelectBox.options[i].selected) {
          descriptionsUrlAddition += "&amp;descriptions=" + escape(descriptionSelectBox.options[i].value);
      }
  }
  </code></pre>
  
  <p>I have a test entry in the database whose description is:</p>
  
  <p>AAA `~!@#$%^&amp;*()_+-={}|[]\:";'&lt;>?,./ And wow this has a lot of special characters. </p>
  
  <p>With the code above, for some reason when the request gets to the controller, the description loses the + sign (it becomes just a space).</p>
  
  <p>Does anyone know what might be happening and how to fix it? I am not sure if it's something to do with URLs special use of +, or what. I could edit how the descriptions list is populated (maybe escaping there). If you offer this as a suggestion, please use Java specific code (no Apache escape utils classes, etc). </p>
  
  <p>If it helps, using alerts in the JavaScript indicate that the + sign is not being transformed before sending the request. </p>