A best practice when passing query parameters from user interface to an apex controller is to query parameters should be properly sanitized by using JSINHTMLENCODE within the VisualForce Page or Component. This function will encode any special characters in the query parameters to prevent cross-site scripting (XSS) attacks or SOQL injection attacks. For example, ccrz.ccRemoteActions.getProducts('{!JSINHTMLENCODE(searchTerm)}') will encode the searchTerm parameter before passing it to the apex controller. Salesforce Reference: B2B Commerce and D2C Commerce Developer Guide, Security