That's because + is the URL encoding of the space character. To have a literal + in a URL it should be encoded as %2B. Tough to say more without seeing the relevant code, but if you're receiving URLs with unencoded + signs in them then whoever is sending them is making a mistake.
(By the same token, a URL should not have a literal space in it. If there are any, then it's probably due to an unencoded +.)