You are right, if those values were formed by 3rd party. But score is value, so it is safe. And sourcedId was send from lti_module to provider, then i got it back here, and i'm sending it again. Also, as you've proposed, sourcedId was urlquoted.