Mastering Drupal 8

Handling arguments

When you define a route URL, you can add parameters by name to be sent to the display method. These parameters are wrapped in braces, for example, /node/add/{node_type}. The values passed in via the URL are passed to the controller by name, so the name of the variable in the controller function needs to be the same name as the parameter in the URL. The order of the parameters in the function signature doesn't matter, only that they are named the same.

So, if we changed the route URL to mastering_drupal_8/test/{message}, we would change the controller function to:

public function test($message) { return [ '#type' => 'markup', '#markup' => $this->t("Test: " . $message), ];} 

Named parameters are not sanitized by default. ...