2 Questions about security.

[raslin]

i am using php 5 and this is the way i securing data:

 

to be sure its an integer:

 

$var = (int) $_POST["var"];

 

to  work with any string:

 

$var = htmlspecialchars($var, ENT_QUOTES); 

 

is this enough? do i need to add mysql_real_escape_string or the code above is enough for everything?

 

thanks alot!

[trq]

Assuming your going to be using the data in database queries then of course you still need to escape your data properly. the above snippets do NOTHING to protect you against sql injections.

[raslin]

wow, thanks alot!

adding mysql_real_escape_string to every post and get in enough to secure data

that works with mySql?

 

thanks again!

[Mchl]

Actually casting to int is a good protection against injection.