QUERY_STRING is already sanitized