Sanitizing/validating user supplied values in php

Question

I have a function called InputFilter that I use for validating/sanitizing form data and I want to know how to implement it correctly into this? I need to run it through $_GET['media'] . The file that the function InputFilter is in is clean.php and if I try to include clean.php into this it makes my result pages not show when a search is performed. This script below is my search.php . Even when I paste the contents of clean.php into search.php it will make my result pages blank and I am not sure why. Is there any easy way to get this to work or a simple way to sanitize/validate $_GET['media'] ?

$media = isset($_GET['media']) ? $_GET['media'] : 'no_media';
switch($media) {
 case 'all':
  include("all_media.php");
  break;
 case 'only':
  include("only_media.php");
  break;
 default:
  include("def_search.php");
}

I am open to any other way of securing $_GET['media'] .

Answer 1

The switch makes your script very save! No matter what anybody sets as media, there will be no security hole in this code.

To sanitize $_GET check the PHP method filter_input() .