$_GET[”] variable with nonce verification

There are two ways of creating nonce verification for $_GET parameters:

1. If you are coming from a form, you can use the wp_nonce_field function to create your own field. For example:

<form action="edit.php" method="get">
  <input type="text" name="example">
  .....
  <?php wp_nonce_field('my_custom_action', 'my_custom_name'); ?>
  <input type="submit" value="Submit">
</form>

2. If you are coming from a link you created, use the wp_create_nonce function:

$url = admin_url('edit.php?post_type=weather_info&.....&my_custom_nonce=" . wp_create_nonce("my_custom_action'));

And processing the nonce verification at both cases, within your own code happens with the wp_verify_nonce function:

if ((isset($_GET['post_type']) && ..... ) && wp_verify_nonce($_GET['my_custom_nonce'], 'my_custom_action')) {
  .....
}

WordPress offers the Plugin Check (PCP) plugin, that checks for potential issues. In there they also suggest to do a sanitization and unslashing for nonce fields, so actually this would be the final form of how it should be used:

if ((isset($_GET['post_type']) && ..... ) && wp_verify_nonce(sanitize_text_field(wp_unslash($_GET['my_custom_nonce'])), 'my_custom_action')) {
  .....
}