IMHO, it is not good practice to use $_REQUEST. If you do not know what type of form you created or what method used in the url you are opening yourself up to a world of hurt. Also, it is good practice to validate all input coming into your site, this should guard against cross site scripting and sql injection. If you need more info on these topics, google arround for XSS, SQL injection, and validate/escape data.