Passing values in URL

[Stephen68]

Ok I was told that doing this was not really safe and that people can add stuff to the end of it

to mess things up. With this is as longs as I use

strip_tags()

and

mysql_real_escape_string()

and maybe cast to the type I would like (string,int) It should be ok.

 

AM I correct in my thinking on this?

 

Stpehen

[mrMarcus]

mysql_real_escape_string() is used in conjunction with a cleaning variables for use with a database.  using it without an sql connection will result in an error.

 

but yes, you are correct in thinking that cleaning variables is a good idea.  i'm sure there are thousands of threads already created about this exact same topic .. why not try searching the forums to see what you can find.