My question is about sanitizing user input data before using it. I am not very experienced in neither PHP or this sanitizing subject so I apologise in advance if this question might come across as dumb.
I have created a very simple search formular for a website, that allows a visitor to search after some custom posts types by different fields. The search form sends some strings by GET request and the data is then processed in a pre_get_posts where I alter the $query object. Right now I use no sanitisation at all: I directly use get_query_var( 'var1' ) to alter the query. So my question is this: is this OK, is it safe? Can I just use a string from a GET request directly like this or should i perform some sanitisation on it before using and in that case - which functions should i use to "clean" it.
Please remember, that I a COMPLETE beginner on this subject so please remember this in your answer. And also please remember that I have tried to read other threads on Stackoverflow on this very subject but to be honest - they have almost left me more confused than before I began. I know from reading these threads, that you have to sanitise the data according to how you plan to use the data. In my case that is as explained - to use it to create the post query from the GET requests.
Thanks in advance!
EDIT: Just to tell a little bit more about the data send by the GET request. My search form consists of some drop down menus with preconfigured strings. So I of course dont accept any HTML code in the request data. I have found the functions htmlspecialchars and filter_var($str, FILTER_SANITIZE_STRING), but are these enough to sanitize the string and do they accomplish the same?