Yes, I overlooked that. Thanks for noticing !
As this is something that could be use in many cases, we could perhaps put this "cleaning" function somewhere in the core ? Is it possible (and ok from a best practice point of view ?) to either overwrite $request.getQueryString(), or to add a $request.getCleanQueryString() method ? It would definitely make things easier from a security point of view if we provide such a tool and that people use it !