Empty reply for this URL:

$ curl -v "http://myhost.example.com/?q=SELECT+%22%%22+FROM+%22+WHERE+%81+"
* About to connect() to myhost.example.com port 80
*   Trying xxx.xx.xx.xx... * connected
* Connected to myhost.example.com (xxx.xx.xx.xx) port 80
> GET /?q=SELECT+%22%%22+FROM+%22+WHERE+%81+ HTTP/1.1
User-Agent: curl/7.12.1 (i686-redhat-linux-gnu) libcurl/7.12.1 OpenSSL/0.9.7a zlib/1.2.1.2 libidn/0.5.6
Host: myhost.example.com
Pragma: no-cache
Accept: */*

* Empty reply from server
* Connection #0 to host myhost.example.com left intact
curl: (52) Empty reply from server
* Closing connection #0

But with the last character(+) removed, the server returns 401 as I assumed.

$ curl -v "http://myhost.example.com/?q=SELECT+%22%%22+FROM+%22+WHERE+%81"
* About to connect() to myhost.example.com port 80
*   Trying xxx.xx.xx.xx... * connected
* Connected to myhost.example.com (xxx.xx.xx.xx) port 80
> GET /?q=SELECT+%22%%22+FROM+%22+WHERE+%81 HTTP/1.1
User-Agent: curl/7.12.1 (i686-redhat-linux-gnu) libcurl/7.12.1 OpenSSL/0.9.7a zlib/1.2.1.2 libidn/0.5.6
Host: myhost.example.com
Pragma: no-cache
Accept: */*

< HTTP/1.1 401 Authorization Required
< Date: Wed, 26 Mar 2008 13:54:30 GMT
< Server: Apache/2.2.8 (Unix) DAV/2 PHP/5.2.5
< WWW-Authenticate: Basic realm="experimental"
< Content-Length: 401
< Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>401 Authorization Required</title>
</head><body>
<h1>Authorization Required</h1>
<p>This server could not verify that you
are authorized to access the document
requested.  Either you supplied the wrong
credentials (e.g., bad password), or your
browser doesn't understand how to supply
the credentials required.</p>
</body></html>
* Connection #0 to host myhost.example.com left intact
* Closing connection #0

Server configuration is:

# /my/path/to/apache228/bin/httpd -V
Server version: Apache/2.2.8 (Unix)
Server built:   Feb 19 2008 11:13:23
Server's Module Magic Number: 20051115:11
Server loaded:  APR 1.2.12, APR-Util 1.2.12
Compiled using: APR 1.2.12, APR-Util 1.2.12
Architecture:   64-bit
Server MPM:     Prefork
  threaded:     no
    forked:     yes (variable process count)
Server compiled with....
 -D APACHE_MPM_DIR="server/mpm/prefork"
 -D APR_HAS_SENDFILE
 -D APR_HAS_MMAP
 -D APR_HAVE_IPV6 (IPv4-mapped addresses enabled)
 -D APR_USE_SYSVSEM_SERIALIZE
 -D APR_USE_PTHREAD_SERIALIZE
 -D SINGLE_LISTEN_UNSERIALIZED_ACCEPT
 -D APR_HAS_OTHER_CHILD
 -D AP_HAVE_RELIABLE_PIPED_LOGS
 -D DYNAMIC_MODULE_LIMIT=128
 -D HTTPD_ROOT="/my/path/to/apache228/apache228"
 -D SUEXEC_BIN="/my/path/to/apache228/apache228/bin/suexec"
 -D DEFAULT_PIDLOG="logs/httpd.pid"
 -D DEFAULT_SCOREBOARD="logs/apache_runtime_status"
 -D DEFAULT_LOCKFILE="logs/accept.lock"
 -D DEFAULT_ERRORLOG="logs/error_log"
 -D AP_TYPES_CONFIG_FILE="conf/mime.types"
 -D SERVER_CONFIG_FILE="conf/httpd.conf"