Question

Here is my code:

<?php
$id = $_GET["id"];

if (is_int($id) === FALSE)  {
    header('HTTP/1.1 404 Not Found');
    exit('404, page not found');
    }
?>

It always enters inside the if.

Answer 1

is_int checks that the data type is an integer, but everything in $_GET will be a string. Therefore, it will always return false.

In a pinch, you could cast to an integer and then check for != 0.

$id = isset($_GET['id']) ? (int) $_GET['id'] : null;

if (!$id) { // === 0 || === null
  header('HTTP/1.1 404 Not Found');
  exit('404, page not found');
}

But a more robust solution would involve some type of input string validation / filtering, like PHP’s built-in filter_input_array().

(Edited post on Oct/13 since it is still receiving upvotes and it was somewhat confusingly worded.)