Now 'query' param will be extracted from database instead of trusting UR...

...L param to prevent potential XSS exploitation