title: Do not Access Superglobal $_REQUEST Array Directly
body: <p>I have until now been accessing $_REQUEST in my PHP as follows:</p>
  
  <pre><code>//JS
  xmlhttp.open("GET", "logic.php?q=" + itemOne  + "&amp;w=" + itemTwo, true);
  
  //PHP
  $q = $_REQUEST['q'];
  $w = $_REQUEST['w'];
  </code></pre>
  
  <p>The items being sent through get used for MSSQL server queries (SQLSRV). </p>
  
  <p><strong>My question is what would be the best-practice methods for doing the above differently/correctly?</strong> I read somewhere that this is not good in terms of being vulnerable to SQL injection attacks etc.</p>