encodeURIComponent escapes the URL-reserved characters : / ? # [ ] @ & = + $ , so it is correct for a single query-string value. encodeURI leaves them alone so a complete URL stays functional. Using the wrong one is the classic bug: encoding a whole URL as a component makes it unusable, and encoding a parameter as a full URL lets an embedded & split your query string.
When should + mean a space?
Only in application/x-www-form-urlencoded data — that is, HTML form submissions and traditional query strings. In URL paths, + is a literal plus sign. Getting this wrong turns "C++" into "C " or a space into a stray plus.
Which characters are safe to leave unencoded?
The RFC 3986 unreserved set: A–Z, a–z, 0–9, hyphen, underscore, period and tilde. Everything else should be percent-encoded in a value. Note that encodeURIComponent also leaves ! ' ( ) * alone, which is fine for URLs but occasionally trips up strict server-side parsers.