What are the potential pitfalls of using $_GET['var'] in PHP scripts?

Using $_GET['var'] directly in PHP scripts can be vulnerable to injection attacks, as it allows users to manipulate the URL parameters and potentially execute malicious code. To prevent this, it is important to sanitize and validate any input received from $_GET before using it in your script. One way to do this is by using filter_input() function with FILTER_SANITIZE_STRING or FILTER_SANITIZE_NUMBER_INT filter flags.

$var = filter_input(INPUT_GET, 'var', FILTER_SANITIZE_STRING);