Can a URI var ever be malicious?

[eluser]theshiftexchange[/eluser]
[quote author="luismartin" date="1334901729"]Yes, it would be possible through POST.[/quote]

But in my example above I am not looking at any POST - just the passed var $plan, which comes through the URI?