Good point, but with ajax this is very common. There are also frameworks that abstract "params" into GET+POST+COOKIES, since they are all under user control in theory the security level is the same, but actually the img trick changes this.