PHP Security Advice on $_GET (combining clean URLs with query string)
<p>I am using "clean" URLs like this:</p>

<pre><code>http://localhost/controller/action/param
</code></pre>

<p>I access the parameters with a custom function like this my_get(1), my_get(2), etc...</p>

<p>However there are times where I think I need to combine them with query strings.
For example: If I need parameter values containing paths with several slashes like:</p>

<pre><code>http://localhost/controller/action/param?mypath=foo/bar/qux.jpg
</code></pre>

<p>I do that because it would be a little harder to implement if done with clean URL.</p>

<p>Now my question is, in combining clean URL and with query string, I only intend to allow this character class:</p>

<pre><code>[.&amp;=a-z0-9\/_-]
</code></pre>

<p>I was wondering would there be any security issue with it? Should I disallow certain characters?</p>
