Allowing only question marks in input

[eluser]tonanbarbarian[/eluser]
im sure you have a reason for passing an API key via GET, i.e. in a URL, however I would consider that a little bit insecure
I would recommend looking at other ways to handle this if possible.
submission via POST and then storing in the session would be one way