demonstrate escaping with query string

slash in value would be interpreted as a path separator in the URL

docs/quickstart.rst

@@ -139,18 +139,16 @@ how you're using untrusted data.
 
 .. code-block:: python
 
+    from flask import request
     from markupsafe import escape
 
-    @app.route("/<name>")
+    @app.route("/hello")
-    def hello(name):
+    def hello():
+        name = request.args.get("name", "Flask")
         return f"Hello, {escape(name)}!"
 
-If a user managed to submit the name ``<script>alert("bad")</script>``,
+If a user submits ``/hello?name=<script>alert("bad")</script>``, escaping causes
-escaping causes it to be rendered as text, rather than running the
+it to be rendered as text, rather than running the script in the user's browser.
-script in the user's browser.
-
-``<name>`` in the route captures a value from the URL and passes it to
-the view function. These variable rules are explained below.
 
 
 Routing