Question

I’m using PDO, and my $_POST['arraywithdata'] is an array filed with numeric values. I think that this is not enough secure, I just wan’t to be sure and prevent myself from a hack.

This is my code:

$arr = $_POST['arraywithdata'];
$SQL->query("UPDATE `data_s` SET `set` = 1 WHERE `id` IN " . implode(", ", $arr));

As you can see, I’m not checking if the post code in a int or something.

Should I rather use something like:

implode(", ", (int) $arr)

?

I guess the above will not work, since array can not be an integer.

Answer 1

You need to convert each value of the array and not the array itself. You can use array_map to do so:

implode(", ", array_map('intval', $arr))

Here array_map will apply intval to each value of $arr and return a new array with the return values.

But as you’re using PDO, you might also be interested in a PDO solution.