The Open Data Protocol or OData is a great protocol created on top of Web Technologies.It uses the URI convention for the data exchange using Atom, JSON and XML. You can use the URI convention (parameter &) to perform your query:
Let's suppose that this is the query to retrieve information related to a specific product in our repository. My point in that somebody could see this query format in a Web page and modify it to retrieve another product, even when it is not authorized to access it. This scenario can shows up when those OData Services are consumed using a Client Side approach like JQuery.
Does that make sense?