FWIW, I think your conclusion is right. They're invalid because they are double encoded. Your logs will show the plain, human readable query strings, not encoded strings, which means the literal query string coming from the client's request actually looks like c%253D1%253Bu%253D1...
In reply to Re: CGI of url-encoded query string
by Your Mother
in thread CGI of url-encoded query string
by glendeni
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |