RESTful URLs are minimal. Query strings are discouraged, and most data is passed in the request in some serialized format. Couple this with the HTTP method and you get a much easier to maintain dispatching situation on the server. Sanitizing what is in any request you send is just part of the deal, it doesn't matter if it's in the URL or not. So I am not sure I get your issue.