if username was '?fakeparam=heyho&else=', you could give any URL parameter you want.
The characters '?' is now escaped.