I recently read a tutorial (<http://code.tutsplus.com/tutorials/a-beginners-guide-to-http-and-rest--net-16340>) on determining the HTTP headers to change the action of a script. The tutorial gives an example of a PHP script to accomplish this 

```
$method = $_SERVER['REQUEST_METHOD'];

switch($method) {
  case 'PUT':
    $this->create_contact($name);
  break;

  case 'DELETE':
    $this->delete_contact($name);
  break;

  case 'GET':
    $this->display_contact($name);
  break;

  default:
    header('HTTP/1.1 405 Method Not Allowed');
    header('Allow: GET, PUT, DELETE');
   break;
}

```

...and mentions

> 
> We use a switch statement, which should be avoided in a real
>  application:
> 
> 
> 

Several questions:

1. Why would you avoid using this function?
2. Is there a vulnerability in using the switch statement itself, or is it the $\_SERVER variable that makes it vulnerable?
3. An answer in this post ([Is $\_SERVER['QUERY\_STRING'] safe from XSS?](https://stackoverflow.com/questions/4581837/is-serverquery-string-safe-from-xss)) recommends the use of htmlentities to protect $\_SERVER values. Is this sufficient?

Thanks very much!