The rails "automatically" process the parameters with the following logic.
If the request is GET, it will decode something in the query string:
GET http://server/controller?value=ab%23cd On the server this will generate params['value'] as ab
If the request is a POST with a query string, it will not decode it:
POST http://server/controller?value=ab%23cd On the server this will generate params['value'] as ab%23cd
If the request is a POST with data parameters, it will decode it:
POST http://server/controller data: value=ab%23cd On the server this will generate params['value'] as ab
I suspect you are seeing this problem because you include the query string with the POST request instead of the GET request, and therefore Rails does not decrypt the query string.
source share