My only idea to get around this would be to configure a list of parameter names in the template system where spaces can safely be reconverted to +-characters.

Well, you're free to encode your data anyway you want (as long as the resulting URL is valid), but if you're not using "CGI encoding", you shouldn't have CGI::Util::unescape decode it. You should do one of these:

1. 1. Encode your data in BASE64.
   2. CGI-encode the BASE64 data.
   3. Send the data over the wire.
   4. CGI-decode the data.
   5. BASE64 decode the data.
2. 1. Encode your data in BASE64.
   2. Send the data over the wire.
   3. BASE64 decode the data.
3. 1. CGI-encode the BASE64 data.
   2. Send the data over the wire.
   3. CGI-decode the data.
4. Something else.

But you shouldn't not-CGI-encode the data on one end, and CGI-decode it on the other.