I came across something like this in a big codebase the other day. Experienced developers weren't paying attention to query string encoding, and this created a

I came across something like this in a big codebase the other day. Experienced developers weren't paying attention to query string encoding, and this created a huge security problem where two different services could be processing different entites because of parameter injection. Imagine if I logged in with the email "sdflhasjd@gmail.com&email=admin@service.com". Service A thinks my email is invalid, it gets passed to another service without re-encoding and then Service B thinks I'm a superadmin. Uh oh.