[nhawk]

You also need to understand the difference between GET, POST and REQUEST. In general...

GET = Anything passed via a URL
POST = Anything passed via an input (<input type=...etc>)
REQUEST = All GET, POST and COOKIE data.

Using these with vB and not cleaning them with $vbulletin->input->clean.. is bad practice as this could possibly introduce rogue code into the system.

This code..

$vbulletin->input->clean_gpc('r', 'mystr', TYPE_STR);

Could be passing more information than you need.

It's best to narrow down what you need with

$vbulletin->input->clean_gpc('p', 'mystr', TYPE_STR);

or

$vbulletin->input->clean_gpc('g', 'mystr', TYPE_STR);

If I'm wrong on that, someone please correct me.