Special characters other than spaces are replaced with their UTF-8 value in hex, each byte preceeded by a '%':
'+' becomes '%2B',
'%' becomes '%25',
etc.

$cgi->param() and $cgi->params() will properly unescape everything for you.