Your universal sanitizer is bad. It does way more than it ever should for a single use, and doesn't even do some things you'll need.
Here's how you sanitize stuff, in chronological order:
1. When stuff comes from the URL or a form
and magic_quotes is enabled then, and only then, stripslashes() it. Do that as early as possible.
2. If you specifically want to remove -
remove - anything that looks like an HTML tag then use strip_tags(). Do that as early as possible.
3. When you put a string directly into a SQL query and you aren't sure what characters it could contain, use mysql_real_escape_string(). Do that right when you put it into the query.
4. If you're putting something into a link (like an <A>) and you aren't sure what characters it could contain, use urlencode(). Do that right when you put it into the URL.
5. When you put a string directly into HTML and you aren't sure what characters it could contain, use htmlspecialchars() or htmlentities(). Do that right when you put it into the HTML. Mind your ENT_QUOTEs.
So
PHP Code:
echo "<a href='somepage.php?view=", htmlentities(urlencode($userShop), ENT_QUOTES), "'>", htmlentities($userShop), "</a>";