filter_var是否保证$_SERVER["QUERY_STRING"]不会受到XSS注入的保护

############################################
## Connection Creation for Both Databases ##
############################################
//Create Connection for Pokemon Test Database
$PokemonConnection=mysqli_connect("URL","username","password","database");
//Check Pokemon Test Database Connection for Errors
if (mysqli_connect_errno()) {
    echo "Failed to connect to MySQL: " . mysqli_connect_error();
}
//Create Connection for Xenforo Forum Database
$XenConnection=mysqli_connect("URL","username","password","database");
//Check Xenforo Forum Database Connection for Errors
if (mysqli_connect_errno()) {
    echo "Failed to connect to MySQL: " . mysqli_connect_error();
}
############################################
###Password Protection for Initialization###
############################################
//Sanitize Password Passed From xenForo and Redirect If Invalid ID
$Password = filter_var($_SERVER["QUERY_STRING"], FILTER_SANITIZE_ENCODED, FILTER_SANITIZE_EMAIL);
if($Password != 'Password')
{
    header("Location: http://www.url.com/error.html");
    echo 'Invalid String Length';
    exit;
}

这是我的代码，它开始了我的脚本的初始化，我担心如果我选择继续我当前的脚本实现，我可能没有得到足够的保护来防止注入。

我已经读到变量过滤可以防止这种情况，但我也看到了可以忽略的例子，如果使用QUERY_STRING，可以在URL中使用语法来利用脚本。