I'm testing drupal website and I've noticed that search query gets appended to the base URL in the response, like so:
query: "hey ho: there" http://www.baseurl.com/search/node/hey ho%3A there query: "dis iz stackexchange!" http://www.baseurl.com/search/node/dis iz stackexchange! query: "@ # $ % ^ & * ( ) < > [ ]" http://www.baseurl.com/search/node/%40 %23 %24 %25 ^ %26 * ( ) < > [ ]
- Is this behavior dangerous?
- Any guess why any of the '* ( ) < > [ ] !' aren't escaped?