The problem wasn&#x27;t that they were trusting GET params it&#x27;s that they forgot that they weren&#x27;t the only ones capable of sending requests. If you wrote a website that could old be accessed by people&#x2F;computers you trust then trusting the parameters is no problem.<p>TL;DR It&#x27;s not how the data is sent but where it came from.