[jdsnape]

HTTPS does encrypt query parameters, all of the HTTP request goes inside the encrypted session.

The only thing outside is the hostname, if the connection is not using the latest versions