> Wrong. The guys who invented the protocol/language thought of that, of course. Thats just basic escaping, you know. Try typing "&" into a some box, e.g. the google search box. The browser will convert it to "%26amp;" and if you type "%26amp;", it will turn into "%2526amp;". So, unless the user was talking to the server directly with telnet or something, everything will be properly escaped and the server will get exactly what the user typed.

No, not wrong. You are talking about URL encoding in HTTP GET, I am talking about encoding characters outside the current character set in form data. These are two different layers of encoding, applied on top of each other.

If you type a non-ASCII character into a form that is using ASCII encoding, it will first be converted to &#nnnn;. Then, if it is submitted over HTTP GET, it will be further encoded as %26%23nnnn;. Thus, you still can't tell if the user typed &#nnnn;, or if the browser auto-converted.