[SOLVED] Prevent SQL Injection

[otuatail]

Hi Guys. Is there a way of making sure a value in a query string is an int as there is not type safe declarations to use here in PHP.

 

TIA

 

Desmond.

 

[MadTechie]

here some examples, that i use

<?php

//Int #1
$number = (int)$number;
$query = "SELECT * FROM users WHERE number=$number";

//Int #2
$query = sprintf("SELECT * FROM users WHERE number=%d",
            $number);

//Int #3 (i don't use this one i would use #1 instead, but that personal pref.)
settype($number, "integer");
$query = "SELECT * FROM users WHERE number=$number";

//String
$query = sprintf("SELECT * FROM users WHERE user='%s' AND password='%s'",
            mysql_real_escape_string($user),
            mysql_real_escape_string($password));

?>

 

EDIT: i would recommned using Int #2 and String for all SQL querys out of habbit, if you have a function that require an int then use Int #1 (if the var is being used in other places as well)

[sammeh]

I always use :

 

<?php
         $number = (int)$number;
?>

[otuatail]

Great thanks for all that.

 

Desmond.