Here is a link to the most relevant discussion we have had previously  
if you would like to refresh your memory: http://groups.google.com/group/oauth/browse_thread/thread/a8398d0521f...

The specific problem that I am encountering right now is that the  
Ruby, PHP,  and Objective-C OAuth libraries handle percent encoding of  
incoming parameters differently.

In the Ruby library all parameters are percent encoded with '+' chars  
being converted to space encodings ( '%20' ), in the PHP lib  
parameters containing '+'s are left as is.

So, the resulting signature base strings for a query parameter key/
value pair of: c=hi+there would come out in the SBS as follows for  
each lib:

Ruby:        c%3Dhi%2520there
PHP:         c%3Dhi%25Bthere

The Objective-C lib behaves like the PHP lib except it doesn't seem to  
be encoding the % of the %2B a second time per section 9.1.3 so the  
resulting part of the SBS looks like:
c%3Dhi%2Bthere

So, I would like to know which approach is correct? Should a '+' in a  
query string get decoded to a space first ( as is a common practice )  
and then percent encoded to %20 per RFC 3986, or should our libs leave  
the '+' as is and encode it as %2B?

Also, I wonder if it might be slightly more clear if section 5.1 of  
the spec ( http://oauth.net/core/1.0/#encoding_parameters ) read: "All  
request parameter names and values..." instead of "All parameter names  
and values..." just to further clarify that all query part of form  
encoded name values including the OAuth Protocol Params must be escaped.