lets do some basic escaping of the get parameter, i.e limit to alpha numeric values .. avoiding things like \n while php does block against this https://bugs.php.net/bug.php?id=60227 it would still be best practice to filter the string