On the OWASP site on XSS it says that it is safe to put userdata in GET parameter values when encoded.
However, userdata should not be used anywhere else, so not in the scheme, the domain or parameter names. Unfortunately I can't find any clues why it would be unsafe in parameter names.
Can anyone show me an example or explanation of what might happen if you do? Obviously I would still use url encoding on the parameter name.