Question

First thank you for reading my question.

During this days, i saw that there are a lot of “malicious” url query running at my website,so i was afraid if my php script is vulnerable to sql injections.

My url structure is: http://mywebsite.com/post.php?id=7573
To get all info i need from a post i use the post id from URL.

To “clear” this ID i use this method:

$id = mysql_real_escape_string ($id);
$safeID = intval(preg_replace("/[^0-9]/", "", $id));
$sql = "SELECT * FROM web_content WHERE state = '1' AND ID = '$safeID'";
$res = mysql_query($sql) or die (mysql_error());
$row = mysql_fetch_assoc($res);
.........

Please i need to know if the safeID, that is sent to database, is really “SAFE”.

Thank you

Answer 1

It could be just as easy as using intval($id)