It’s what happens when content is url encoded and not decoded again later. It’s easy to do by accident because you can’t tell if a string is already url encoded in any general way, so the processes responsible for sending and receiving need to agree on how/when to encode and decode (i.e. they both have the power to break it for the other)