If this JavaScript executes in browser, it's just a bug. If user types 'abc&d=e', it might not post this text. It's unlikely to be a security issue, because ser

If this JavaScript executes in browser, it's just a bug. If user types 'abc&d=e', it might not post this text. It's unlikely to be a security issue, because server must check all requests anyway, as user can send anything. If this JavaScript executes in a server (e.g. some kind of microservice call), it might be a security issue, indeed, as some people treat internal calls as trusted ones (although they probably should not).