diff --git a/contrib/prometheus-exporter/service-prometheus.c b/contrib/prometheus-exporter/service-prometheus.c
index 54f3732..b2cf9c8 100644
--- a/contrib/prometheus-exporter/service-prometheus.c
+++ b/contrib/prometheus-exporter/service-prometheus.c
@@ -2277,7 +2277,7 @@
 			*(p++) = 0;
 		else if (*p == '#')
 			*p = 0;
-		len = url_decode(key);
+		len = url_decode(key, 1);
 		if (len == -1)
 			goto error;
 
@@ -2291,7 +2291,7 @@
 				*(p++) = 0;
 			else if (*p == '#')
 				*p = 0;
-			len = url_decode(value);
+			len = url_decode(value, 1);
 			if (len == -1)
 				goto error;
 		}
diff --git a/doc/configuration.txt b/doc/configuration.txt
index 118bd97..64c57d9 100644
--- a/doc/configuration.txt
+++ b/doc/configuration.txt
@@ -14527,9 +14527,13 @@
   sample fetch function or after a transformation keyword returning a string
   type. The result is of type string.
 
-url_dec
-  Takes an url-encoded string provided as input and returns the decoded
-  version as output. The input and the output are of type string.
+url_dec([<in_form>])
+  Takes an url-encoded string provided as input and returns the decoded version
+  as output. The input and the output are of type string. If the <in_form>
+  argument is set to a non-zero integer value, the input string is assumed to
+  be part of a form or query string and the '+' character will be turned into a
+  space (' '). Otherwise this will only happen after a question mark indicating
+  a query string ('?').
 
 ungrpc(<field_number>,[<field_type>])
   This extracts the protocol buffers message field in raw mode of an input binary
diff --git a/include/common/standard.h b/include/common/standard.h
index 1698d75..38e2bb7 100644
--- a/include/common/standard.h
+++ b/include/common/standard.h
@@ -561,8 +561,12 @@
  * be shorter. If some forbidden characters are found, the conversion is
  * aborted, the string is truncated before the issue and non-zero is returned,
  * otherwise the operation returns non-zero indicating success.
+ * If the 'in_form' argument is non-nul the string is assumed to be part of
+ * an "application/x-www-form-urlencoded" encoded string, and the '+' will be
+ * turned to a space. If it's zero, this will only be done after a question
+ * mark ('?').
  */
-int url_decode(char *string);
+int url_decode(char *string, int in_form);
 
 /* This one is 6 times faster than strtoul() on athlon, but does
  * no check at all.
diff --git a/src/http_conv.c b/src/http_conv.c
index 93b748c..803d7bc 100644
--- a/src/http_conv.c
+++ b/src/http_conv.c
@@ -217,6 +217,7 @@
 /* This fetch url-decode any input string. */
 static int sample_conv_url_dec(const struct arg *args, struct sample *smp, void *private)
 {
+	int in_form = 0;
 	int len;
 
 	/* If the constant flag is set or if not size is available at
@@ -233,7 +234,11 @@
 
 	/* Add final \0 required by url_decode(), and convert the input string. */
 	smp->data.u.str.area[smp->data.u.str.data] = '\0';
-	len = url_decode(smp->data.u.str.area);
+
+	if (args && (args[0].type == ARGT_SINT))
+		in_form = !!args[0].data.sint;
+
+	len = url_decode(smp->data.u.str.area, in_form);
 	if (len < 0)
 		return 0;
 	smp->data.u.str.data = len;
@@ -332,7 +337,7 @@
 	{ "language",       sample_conv_q_preferred,  ARG2(1,STR,STR),  NULL,   SMP_T_STR,  SMP_T_STR},
 	{ "capture-req",    smp_conv_req_capture,     ARG1(1,SINT),     NULL,   SMP_T_STR,  SMP_T_STR},
 	{ "capture-res",    smp_conv_res_capture,     ARG1(1,SINT),     NULL,   SMP_T_STR,  SMP_T_STR},
-	{ "url_dec",        sample_conv_url_dec,      0,                NULL,   SMP_T_STR,  SMP_T_STR},
+	{ "url_dec",        sample_conv_url_dec,      ARG1(0,SINT),     NULL,   SMP_T_STR,  SMP_T_STR},
 	{ NULL, NULL, 0, 0, 0 },
 }};
 
diff --git a/src/standard.c b/src/standard.c
index 7fc4fd7..b593345 100644
--- a/src/standard.c
+++ b/src/standard.c
@@ -1731,8 +1731,12 @@
  * be shorter. If some forbidden characters are found, the conversion is
  * aborted, the string is truncated before the issue and a negative value is
  * returned, otherwise the operation returns the length of the decoded string.
+ * If the 'in_form' argument is non-nul the string is assumed to be part of
+ * an "application/x-www-form-urlencoded" encoded string, and the '+' will be
+ * turned to a space. If it's zero, this will only be done after a question
+ * mark ('?').
  */
-int url_decode(char *string)
+int url_decode(char *string, int in_form)
 {
 	char *in, *out;
 	int ret = -1;
@@ -1742,7 +1746,7 @@
 	while (*in) {
 		switch (*in) {
 		case '+' :
-			*out++ = ' ';
+			*out++ = in_form ? ' ' : *in;
 			break;
 		case '%' :
 			if (!ishex(in[1]) || !ishex(in[2]))
@@ -1750,6 +1754,9 @@
 			*out++ = (hex2i(in[1]) << 4) + hex2i(in[2]);
 			in += 2;
 			break;
+		case '?':
+			in_form = 1;
+			/* fall through */
 		default:
 			*out++ = *in;
 			break;
diff --git a/src/stats.c b/src/stats.c
index f2cb099..f2091bb 100644
--- a/src/stats.c
+++ b/src/stats.c
@@ -2918,7 +2918,7 @@
 				/* Ok, a value is found, we can mark the end of the key */
 				*value++ = '\0';
 			}
-			if (url_decode(key) < 0 || url_decode(value) < 0)
+			if (url_decode(key, 1) < 0 || url_decode(value, 1) < 0)
 				break;
 
 			/* Now we can check the key to see what to do */