Do not pass POST data to the `deserialize()` function (see #6695)

Do not pass POST data to the `deserialize()` function, so it is not vulnerable to PHP object injection. Thanks to Pedro Ribeiro for his input.
Correctly encode URLs with GET parameters in the syndication links (see #6683)