I was reading a Q&A on enabling
+ characters in URLs for Sitecore CMS, and the answer states:
ASPNET application does not allow using “+” from the security point of view e.g. preventing SQL or JScript attack via URLs.
Essentially a url such as
http://example.com/foo%20bar is allowed in the system, while
http://example.com/foo+bar is not.
I have never heard of
+ characters being used as any sort of attack vector for SQL injection or XSS, but that doesn't mean that there isn't one.
+ as an alternative to
%20 an attack vector of any sort?
NOTE: I've tagged XSS and sql-injection because they were called out explicitly in the article