Regardless of whether you registered
new_var as a query_var, all GPC data (GET, POST, COOKIE) should be considered tainted. Basically, this data is user input. This means that you will need to clean and validate the data anyway.
Common cleaning methods include casting the variable to a certain type (like integer or string), using a regex to validate strings, etc. Also, if you are accessing
$_GET data directly, don't forget to do an
empty() check first to prevent "undefined index" notices.
Edit: In the first place, my answer applies to accessing GPC data via PHP's superglobals. That being said, if you use
get_query_var() to retrieve your variable, as far as I see, you still need to clean the variables you registered yourself. WP will clean its standard query vars, of course. See the
parse_query() function in