It can.
See command-line options. WinSCP treats session-specification on command-line as an URL. Hence any character that has special meaning in URL must be URL-encoded. This means it must be entered in format %XX, where XX is hexadecimal ASCII code. Some common examples:
%20 or +%: %25 (percent sign)+: %2B (plus sign)/: %2F (slash)@: %40 (at sign)