This depends on what
something() is doing. In general, you don't want users to be able to pass arbitrary data into your scripts. Your code does this, as you don't check, if the user input is what you expected it to be.
Saying this in an abstract way: Never make assumptions about what you get!
Example: You generate a SQL query like this:
$sql = "SELECT * FROM table WHERE id = ".$_GET["id"].";"
// execute SQL here
// process results here
Let's assume you get this input from a form, which states, that the "id" field should only be filled with a number (or even use the HTML5 attribute).
This guy inserts a non-numeric value, like
ab"fe; and submits the form. Your request will throw an SQL exception/error as the resulting query is:
SELECT * FROM table WHERE id = "ab"fe;"; invalid SQL
This happened because you assumed, you'd only get numeric values, but nothing prevents a user from sending something else. Even if you use the HTML5 attribute, a users browser may ignore it or the user himself crafts a specific request and sends it to your endpoint. Let's look at a worse scenario.
This guy tries to mess with you and sends
owned"; DROP DATABASE * where the resulting SQL statement is:
SELECT * FROM table WHERE id = "owned"; DROP DATABASE *; poof, you database is gone...
Generally you always want to make absolutely sure, you know what kind of data you are processing. Use methods like
is_numeric() to make sure, that the data contains what you think is does. This process of eliminating unwanted data and preparing it for being used is called sanitizing.
In addition, you should always escape strings before you use them in an SQL statement, to avoid somebody injecting special characters, like
; in SQL.