Security - Die or replace on invalid value for include

Question

I would like to know which of the following solutions is more secure.

if(!ctype_alpha($_GET['a'])){
    //another string can be put here if necessary
    die('No Hacking!');
}

or

if(!ctype_alpha($_GET['a'])){
    //Changed for security in depth, in-case I accidently use $_GET['a'] elsewhere. Designed to simulate header('Location: ./?a=default_value');
    $_GET['a'] = 'default_value';
}

something similar to the following happens later in the script:

//make_safe is defined elsewhere, it is security in depth (redundancy) to remove slashes if they get past ctype_alpha using some unknown bug
$var = make_safe($_GET['a']);
require_once("./data/include/$var.php");

In a book I am currently reading, it says that it is best to stop all input not following my rules, instead of correcting. Therefore, my question boils down to does replacing the $_GET['a'] with a default parameter count as stopping the input, or must die() be used?

Answer 1

Die('fu') is a dirty thing.

I prefer your way of sanitizing inputs with default values if needed.

By the way, that's what does major companies (check at google, search something, go to page 2, now change start parameter in the url to something not numeric, you'll be back to page 1).

Plus, when hacking stuff, you'll try to have the application acting in a singular way.

If yours acts always the same, it's very frustrating for hackers, they'll hopefully feel bored quite quickly.