btw, after looking into the vulnerability I agree it's a good idea to put this option here so the user can provide the parameter name if necessary.