Some time ago i wrote a post about query string and i think i pretty well covered that topic, however i didn’t mentioned one thing … cleaning input variables. In fact it is much more important to know how to clean $_POST and $_GET arrays then know how to handle query string, because variables sent by user are the only way to hack your script, it is that simple, if you take care of input variables then your script is 100% safe.
WordPress Development Magazine
Practical guide to WordPress development, blogging and programming