Question: What if I pass my searching params in uri request in json-format like this:

```
http://example.com/?search={"title":"Some+Title","category":12}

```

instead of

```
http://example.com/?title=Some+Title&category=12

```

Before decode json-request I can filter it with some functions like strip\_tags(), strpslashes(), etc... But I can do the same with $\_SERVER['QUERY\_STRING'] with serialize()/unserialize(). Or apply string-filters to N string-params of request, not once to whole request.

Which way do you think will be better, usable and faster to process?

### With json

```
$request = $_GET['search'];
$request = stripslaches(strip_tags($request));
$params  = json_decode($request);

```

Answer: 
The characters *{* and *}* are unsafe according to RFC 1738 2.2. They must therefore be encoded before being transferred over a network.

The character *:* is reserved according to RFC 1738 2.2. It must therefore be encoded before being transferred over a network unless it is used for the purpose for which it was reserved.

Don't use `$request = striplashes(strip_tags($request))`. If `$_GET['search']` does not `json_decode` sucessfully, treat it as faulty input; don't try to fix it.
Isn't it better to use [`http_build_query`](http://php.net/manual/en/function.http-build-query.php) instead of passing JSON throw URL? HTTP\_build\_query is specially designed to pass data throw url params.

Applying this filter to whole `param_str` of URL may cause unexpected behaviour, besides fact that is actually little bit faster.
I think that you should pass every one parameter throw your filter functions.