Just for safety reasons,
I only relly on global variables I set the value myself.
Otherwise I always use
$HTTPVARS['varname']
where can be one of
GET
POST
SESSION
SERVER
and so on (as long as track_vars is enabled).
In your case you want to use GET.
The GET case is the less critical for security, but make this a rule of thumb because one day you might be reading a global var that you expected to come from your form or even a session, when it was indeed set by a GET variable.
You can control the precedence of variables in your php.ini