Auto parsing query into objects of various types is scary indeed. This could break for all kinds of legitimate or malicious user input if you were not aware of

Auto parsing query into objects of various types is scary indeed. This could break for all kinds of legitimate or malicious user input if you were not aware of it. There is an option called “query parser” which can be set to false to disable it globally. Having a format for such data was probably a good idea but when it’s not defined by http and thus inconsistent across frameworks (php does similar parsing, but differently), and doesn’t have an easy way to access the raw string, I’d just stick to json for complex data. Maybe the assumption is that one should use route parameters instead.