The five tags
utm_source is who sent the visit (newsletter, google, facebook), utm_medium is the kind of link (email, cpc, social), and utm_campaign names the push it belongs to (spring_sale). utm_term is for a paid search keyword and utm_content tells apart two links in the same email or two versions of an ad. Analytics needs a source before it reads the rest.
The address is kept whole
Values are percent-encoded, so a space becomes %20. Any query the address already has is kept, UTM tags already in it are replaced rather than doubled, and a #fragment stays at the end where it belongs. An address typed without https:// is read as https.
Keep the names consistent
Analytics counts Email and email as two different mediums, so it warns when a source, medium or campaign has capitals. Pick one spelling for each and keep to it, or one campaign ends up split over several rows of a report.
Questions
Should I tag links between pages of my own site?
No. A UTM tag on an internal link makes analytics treat the click as a new arrival from that campaign, which hides where the visitor really came from. Tag links on other sites, in emails and in ads.
Will the tags show to visitors?
They are in the address bar, and anyone can read or delete them. Do not put anything private in a tag, such as an email address.