securing query string