title: How to override query params in PHP's $_SERVER?
body: <p>I have a URL with a query param like: <code>www.example.com?src=%27};alert(1);a={%27%27:%27</code>. I want to clean up the URL when the request gets made and return it to the browser without the javascript alert evaluating. By "clean up" I mean: remove html tags, invalid characters, and characters that can potentially evaluate in the user's browser. </p>
  
  <p>This is what I'm thinking and please correct me if I'm thinking about this incorrectly: when the request is made, catch it in the middleware and then send back a cleaned up version of the query params (maybe redirect the user).</p>
  
  <p>I'm not sure if PHP supports this? I thought I could override the query params in <code>$_GET</code> and assign the <code>src</code> param with the cleaned up value but that doesn't seem to be working. I've also tried overriding <code>$_SERVER['QUERY_STRING']</code> but that also doesn't work. </p>
  
  <p>What's the best way to handle something like this in PHP?</p>