at least strips the + operator from all code!!!!!
if used in GET/POST,
is the replacement for a space character. your host’s web editor is just missing the escaping of sent content (I guess this is done through AJAX, as a regular form submit would take care of that).