Wordpress $wpdb->row Query Check
Yes, you should prepare the statement or at least SQL escape the value of $_GET['fromUrl']. It's good practice to be paranoid about any input potentially provided by the user as it will be wrong at some point. 

The wpdb-reference says:


  Briefly, though, all data in SQL queries must be SQL-escaped
  before the SQL query is executed to prevent against SQL injection
  attacks.


The prepared query would look something like this 

$wpdb-&gt;get_row(
       $wpdb-&gt;prepare("SELECT * FROM `my_table` WHERE column = %s",
                      $_GET['fromUrl']),
       ARRAY_A);


which in my opinion is more readable, particularly the SQL query is easier to follow.

Furthermore, inspecting the user input may allow you provide the user better experience by creating meaningful notifications describing what has happened and how the user can cope with the inconvinience.