GET variables with spaces - they work, but is it correct or ok?

Question

I have a PHP page where I\'m passing the city name via a \"city\" URL/GET variable. Currently, it\'s passing the actual city name even if it has spaces (eg .php?city=

Answer 1

Space in URL is fine. One thing you need to take note is whenever working with variable taken from outside your control (URL variable, Cookies, etc, etc). Always remember to clean it up to prevent sql injection, XSS, and other malicious attack.