Decode URL in bash

I'm trying to decode GET arguments in pure bash.

I.e.: hello+%26+world should become hello & world

So far I've managed to get this:

#!/usr/bin/sh
echo "Content-type: text/plain"
echo ""

CMD=`echo "$QUERY_STRING" | grep -oE "(^|[?&])cmd=[^&]+" | sed "s/%20/ /g" | cut -f 2 -d "="`
CMD="${CMD//+/ }"

echo $CMD

which replaces all the + with a space.

Is there a better way to do this? Or do I just have to look for each possible encoded special character and replace it?