Added calls to filter_input and filter_input_array before accessing super globals $_GET and $_SERVER .