You don’t want to get `userName` from query string...

# ktor

[orangy]

You don’t want to get userName from query string and put it like +userName and then have some smart hacker send you a JS script in it 🙂