title: Is Enabling Double Escaping Dangerous?
body: <p>I have an ASP.NET MVC application with a route that allows searching for stuff via /search/&lt;searchterm>. </p>
  
  <p>When I supply "search/abc" it works well, but when I supply "/search/a+b+c" (correctly url encoded) then IIS7 rejects the request with HTTP Error 404.11 (<em>The request filtering module is configured to deny a request that contains a double escape sequence</em>). FIrst of all, why does it do this? It only seems to throw the error if it is part of the URL, but not as part of a query string ( /transmit?q=a+b+c works fine).</p>
  
  <p>Now I could enable double escape requests in the security section of my web.config but I'm hesitant to do so as I don't understand the implications, and neither why the server would reject the request "a+b+c" as part of the URL but accept as part of a query string.</p>
  
  <p>Can someone explain and give some advice what to do?</p>