it just scares me because params is what the server gets from the query-string parameters sent from the client