[kh99]

There is a $vbulletin->GPC_exists[] array, so you could try this:

$vbulletin->input->clean_gpc('r', 'do', TYPE_STR);
if ($vbulletin->GPC_exists['do'])
   $do = $vbulletin->GPC['do'];
else
   $do = "siterules";

// etc

Another thing you could do is just make 'siterules' the default 'else':

$vbulletin->input->clean_gpc('r', 'do', TYPE_STR);
$do = $vbulletin->GPC['do'];

if ($do == 'something')
{
 // something
}
else if ($do == 'somethingelse')
{
// something else
}
else // default to siterules
{
  // siterules
}

BTW, I'm not a php expert so I'm not going to argue with what's correct and what's "evil", but I would say that there was nothing actually wrong with what you originally had (as far as introducing vulnerabilities), and in fact the vb scripts do it that way (just for the 'do' variable).