Security risks of getting query string from