Have you checked HTTP specyfication (RFC2616)?
Take a look at those parts:
- http://www.w3.org/Protocols/rfc2616/rfc2616-sec5.html#sec5.1.2
- http://www.w3.org/Protocols/rfc2616/rfc2616-sec3.html#sec3.2
The practical advice would be to use Base64 to encode the fields that you expect to contain risky characters and later on decode them on your backend.
Btw. Your question is really long. It decreases the chance that someone will dig into it.
