Question

How can I make this query sql injection safe please?
Will JRequest::getVar ensure that the parameter that is passed is sql injection safe?

$product_id = JRequest::getVar('product_id')
$db = JFactory::getDBO();
$query = " select * from #__products where product_id=".$product_id."; ";       
$db->setQuery($query);
$data = $db->loadObjectList();
return $data[0];

Answer 1

Yes, using getVar function to access request variables, will ensure that all user data is filtered before it’s used somewhere else (such as in SQL queries).
getVar method on the JRequest class automatically filters out the input (unless explicitly told otherwise).

You can also use quote to escape strings before inserting to database