decodes some special chars in a URL query

Solves #12200
Unencoding the `=` is not safe. There is a difference between `&foo%3Dbar=baz` and `&foo=bar=baz`!