Form Encoding

When you use -d, curl adds a header describing the body's format:

Content-Type: application/x-www-form-urlencoded

That long name is the format HTML forms have always used: key=value pairs joined by &. The server reads that header and knows to split the body on those characters.

Which raises the obvious question: what if a value contains an & or an =? It has to be escaped, written as a percent sign and two hex digits. A space becomes %20 or +, an ampersand becomes %26.

--data-urlencode does that escaping for you, and you should prefer it for anything a human typed. Sending raw user input through plain -d is how fields mysteriously truncate at the first ampersand.