Currently making an application which needs to parse a query string with repeated values. Right now what I'm doing is something like this.

GET /api/titles?status=green&status=red which returns an array in the req.query.status like this req.query.status: ["green", "red"].

This can get cumbersome on the client side with a long url string when many fields are required. I've discovered that this works as well. GET /api/titles?status=green,red which returns something like this req.query.status: "green,red". I can then split this string into an array by running req.query.status.split(","). This results in an array with the same results to ["green", "red"].

My question is this a recommended way of doing this? Are there any security risks for running this?