Question

dear All.

I’m using integer PKs in some tables of mysql database. Before input from PHP script, I am doing some sanitizing, which includes intval($id) and $mysqli->real_escape_string().

The queries are quite simple

insert into `tblproducts`(`supplier_id`,`description`) values('$supplier_id','$description')

In this example, $description goes through real_escape_string(), while $supplier_id only being intval()’ed.

I’m just curious, if there’re any situations, when I need to apply both intval and real_escape_string to integer I’m inserting into DB? So basically do I really need to use?

$supplier_id = intval($mysqli->real_escape_string($supplier_id));

Thank you.

Answer 1

intval way faster than real_escape_string since real_escape_string has to connect to the database and escaping based on the charset/collation.

you can also cast the int like:

$val = (int)$val;

therefore no need to double sanitize