refactored get-from-qstr/post
added TODO to where function
added SECURITY_WARNING