title: Function to check GET parameter
body: <p>I have a function that does a security check on my GET parameter (I'm not the author):</p>
  
  <pre><code>function GET($name = NULL, $value = false)
  {
      $content = (!empty($_GET[$name]) ? trim($_GET[$name]) : (!empty($value) &amp;&amp; !is_array($value) ? trim($value) : false));
      if (is_numeric($content))
          return preg_replace("@([^0-9])@Ui", "", $content);
      else if (is_bool($content))
          return ($content ? true : false);
      else if (is_float($content))
          return preg_replace('@([^0-9\,\.\+\-])@Ui', "", $content);
      else if (is_string($content)) {
          if (filter_var($content, FILTER_VALIDATE_URL))
              return $content;
          else if (filter_var($content, FILTER_VALIDATE_EMAIL))
              return $content;
          else if (filter_var($content, FILTER_VALIDATE_IP))
              return $content;
          else if (filter_var($content, FILTER_VALIDATE_FLOAT))
              return $content;
          else
              return preg_replace('@([^a-zA-Z0-9\+\-\_\*\@\$\!\;\.\?\#\:\=\%\/\ ]+)@Ui', "", $content);
      } else false;
  }
  </code></pre>
  
  <p>So whenever I'm fetching GET parameter values I call this function. However, if my GET parameter is a string containing special characters like <code>åäö</code> they get replaced. For example, this string <code>Detta är en annons</code> will have the following output: <code>Detta r en annons</code>. </p>
  
  <p>Since I'm sure it's a string variable it's probably the <code>filter_var</code> function that strips my special chars. How should I rewrite the above script to keep my special characters in my string?</p>
  
  <p><strong>Edit</strong></p>
  
  <p>Okay, so above script is thrash. I've been looking at alternatives. If my purpose is to insert the GET parameter value into a database, will <code>filter_input(INPUT_GET,"link",FILTER_SANITIZE_STRING);</code> be sufficient to clean my variable from any malicious code?</p>