Home/ Questions/Q 6787639
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-26T17:23:25+00:00

I am using following method for MySQL queries: $sql = SELECT * FROM mytable

  • 0

I am using following method for MySQL queries:

$sql = "SELECT * FROM mytable WHERE `myTableId`=" . (int)$myId;

Is this a completely safe method or is there a way to inject some sql into the database with this method?
Any better alternative?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    It can lead to unintended consequences, e.g.

    $myId = 'blahblahblah';

    would result in

    ... WHERE myTableId=0

    maybe not such a big deal in this case, but if (say) you’re doing a permissions systme and “super-duper-ultra-high-level-user-with-more-power-than-god” has permission level 0, then it’s a nice way to bypass security.

    • 0