If one seeks to pass a full URL to a web app via a parameter in url, what characters must be escaped to ensure the param URL makes it across intact?

I'm thinking '&', '/', '?', '=', and '%' -- but is there a spec somewhere with the official answer?

With a URL like this

http:://www.mysite.com/mywebapp1/dosomething?url=http://www.myothersit
+e.com/myotherwebapp2/foo.asp?param=1&param=3
[download]

the issue is making sure the webapp2 gets

url = http://www.myothersite.com/myotherwebapp2/foo.asp?param=1&param=
+3
[download]

and that the params of webapp2 aren't taken as params to webapp1.

Thanks for any leads or links