Question

Does POST or GET data need to be validated if being thrown directly into a switch() statement? For example:

switch($_GET['input']) {
    //...
}

???

Answer 1

If your switch contains real cases no, but if you do default you need to validate the $_GET if you use it in that case.

eg:

switch ($_GET['input']) {
    case 'one':
        echo "input is one";
        break;
    case 'two':
        echo "input is two";
        break;
    default:
       // here `$_GET['input']` need to be validated, escaped, checked if you use it to avoid XSS or SQL injections
       echo $_GET['input'];
}