Question

I am wondering, If I have a value I know should be numeric, is multiplying it by 1 a safe method to clean it?

function x($p1){
   $p1*=1;
   sql="select * from t where id ={$p1}";
   //run query..
}

Although my example uses an ID, this is being used for many types of numeric values I have in my app (can be money, can be pai etc).

Answer 1

I don’t see why it wouldn’t be. But what’s wrong with using prepared statements? That’s always going to be safer than using PHP variables directly in SQL statements.