In more detail
Pairs are written name=value and joined by &. Reserved characters in names and values must be percent-encoded (a space becomes %20 or +). There is no single standard for repeated names (?tag=a&tag=b) or arrays (tag[]=a), so frameworks read them differently. The query string is sent to the server, unlike the fragment after #, which stays in the browser. Marketing links add tracking parameters such as utm_source this way.
Why it matters
Query strings are visible in the address bar, server and proxy logs, and the browser history, so never put passwords or tokens in them. Parameters that do not change the content, such as tracking tags or sort orders, create duplicate URLs for search engines; a canonical URL resolves that. An unencoded & inside a value silently splits it into two parameters.
Example
The values q = café & bar and page = 2 encode as:
?q=caf%C3%A9+%26+bar&page=2
é becomes its two UTF-8 bytes %C3%A9, the spaces become + and the & inside the value becomes %26. Left unencoded, ?q=café & bar&page=2 would be read as q=café plus a stray parameter named bar.