It is not a bug, it is a way that request is send to the server. Also please first read the docs how to sanitize such things, by example there is a option autoencode.
Will try to reproduce this and if needed to make some corrections. Also the developer should care of the data passed and retrieved to/from server. This is a long discussion
.
