If you type a '+' in a field it get's converted to
'%2B' before sent to the server. php urldecodes it
twice: '%2B' -> '+' -> ' '.

The problem is in the file:

ext/mbstring/mbstring.c: lines 1033-1045:
val = strchr(var, '=');
        val_list[n] = var;
        len_list[n] = php_url_decode(var, strlen(var));
        n++;
        if (val) { /* have a value */
            *val++ = '\0';
            val_list[n] = val;
            len_list[n] = php_url_decode(val, strlen(val));
        } else {
            val_list[n] = "";
            len_list[n] = 0;
        }

A possible bugfix is:
==== BEGIN diff ===========================================
*** ext/mbstring/mbstring.c.ORIG        Thu Aug  1 07:47:56 2002
--- ext/mbstring/mbstring.c     Fri Oct 25 21:36:40 2002
***************
*** 1032,1041 ****
        while (var)  {
                val = strchr(var, '=');
                val_list[n] = var;
                len_list[n] = php_url_decode(var, strlen(var));
                n++;
                if (val) { /* have a value */
-                       *val++ = '\0';
                        val_list[n] = val;
                        len_list[n] = php_url_decode(val, strlen(val));
                } else {
--- 1032,1042 ----
        while (var)  {
                val = strchr(var, '=');
                val_list[n] = var;
+               if (val)
+                       *val++ = '\0';
                len_list[n] = php_url_decode(var, strlen(var));
                n++;
                if (val) { /* have a value */
                        val_list[n] = val;
                        len_list[n] = php_url_decode(val, strlen(val));
                } else {
============================================================