Not sure if in this case if it is possible to inject malicious code in $entityId and if it will be processed by php.
$entityId = $_GET["name"];
public function getMetaData($entityId) {
assert('is_string($entityId)');
}
Note that using string as the assertion is deprecated since PHP 7.2.