,
is a reserved character. Reserved characters are never equivalent (for normalization purposes) to their percent-encoded variants. So these URIs are not equivalent:
http://example.com/?foo,bar
http://example.com/?foo%2Cbar
Neither the URI standard¹ nor the HTTP/HTTPS URI scheme specs define a special role for ,
in the query component. This means that authors may use ,
to represent data in the query component (i.e., for whatever they want).
It can make sense to use ,
together with %2C
in an URI’s query component. For example, an author could decide to use ,
for separating name-value pairs, and %2C
for representing commas within values:
http://example.com/?score:1%2C4,time:55
(It doesn’t seem to make sense in the example URI in your question, though. Assuming that the values are "blue" and "green", as well as "xl" and "xxl", it would make more sense to either use ,
or %2C
in both cases. Your example URI would make sense if e.g. the latter case is actually one value, so "xl,xxl".)
¹ Note that RFC 2396 is obsolete. IETF’s URI standard should always be accessible under STD 66, which is currently RFC 3986.
I gave a similar answer to the question Possible side effect using comma in querystring? on Stack Overflow.