The following query does not work:
http://localhost/passthru/transform/tamino/SEC/Emp_Sql_View?_XQL=/EMP_view[EMP_LAST_NAME=‘Smith’]&_xslsrc=http://localhost/stylesheets/sectab.xsl
and we get a result of:
Pass thru the Tamino Filter without transformation
which implies to me that the _&xslsrc parameter was never found.
Especially since:
http://localhost/passthru/transform/tamino/SEC/Emp_Sql_View?_XQL=/EMP_view&_xslsrc=http://localhost/stylesheets/sectab.xsl
does work.
Is getParameterValues() not using ‘]’ as a delimiter perhaps?
OK, next time read down the forum! 
Putting in the hex characters does work, but I agree, we should put in the URL encoding and release a patch. One of my co-workers here in Reston was pulling his hair out over this.
Glad you got to the bottom of this!
I wish I knew exactly what the right thing to do here is. The rule is that a URL isn’t a proper URL unless the special characters such as “[” and “]” have been %HH-escaped. It’s not at all clear under what circumstances you get a failure when this rule isn’t followed - it seems to depend on which web server and/or servlet container you are using, for example. And it’s not clear at what point in the processing it would be safe to add %HH-escaping. The simplest rule (and the rule in RFC 2396) is that it should be done at the point where the URL is first constructed: which presumably means, by the user application. That’s not very helpful to someone who has been tearing their hair out, however…
Michael Kay