Are there any best practices for validating GET parameters in PHP?

When working with GET parameters in PHP, it is important to validate the input to prevent security vulnerabilities such as SQL injection or cross-site scripting attacks. One common best practice is to use filter_input() function along with filter_var() function to sanitize and validate the input data. 

// Validate and sanitize GET parameter
$param = filter_input(INPUT_GET, 'param', FILTER_SANITIZE_STRING);

if ($param === false) {
    // Handle invalid input
    echo "Invalid parameter";
} else {
    // Use the sanitized parameter
    echo "Parameter: " . $param;
}

Keywords

filter_input filter_var validation security input validation

Related Questions