Well, it is valid UTF-8, but it's an ASCII control character that's not allowed to appear in XML. No idea why it would appear in input...

As commenter below has already told, this is valid symbol from UTF-8 point of view, but invalid - from XMLs (as far as I remember ASCII from top 12 should be encoded using CDATA tag - correct me if I wrong?). So an only workaround I see at the moment is to process data on the server.

But this still does not solve the question - for what a hell Safari wants to send this %10 to server :)))

Just when I'm debugging stuff. I didn't start capturing my traffic until I realized it was a good last resort: Safari still had the POST data in its cache, and reloading kept re-POSTing, so I figured I could get back my post cleanly. Better than running strings on /dev/kmem or something and sorting through that crap.

I ran tcpdump on OS X, saving the file to a mounted Linux box, then ran ethereal from there using OS X's X server. (been too lazy to install ethereal for OS X, since remote X over gigabit is fine....)