I was reading a Q&A on enabling +
characters in URLs for Sitecore CMS, and the answer states:
ASPNET application does not allow using “+” from the security point of view e.g. preventing SQL or JScript attack via URLs.
Essentially a url such as http://example.com/foo%20bar
is allowed in the system, while http://example.com/foo+bar
is not.
I have never heard of +
characters being used as any sort of attack vector for SQL injection or XSS, but that doesn't mean that there isn't one.
Is +
as an alternative to %20
an attack vector of any sort?
NOTE: I've tagged XSS and sql-injection because they were called out explicitly in the article