Question

In various mysql queries, the end part of the query string is:

" WHERE UserID = " . $AccID

where

$AccID = $_SESSION['UID'];

and UserID is the respecting bigint column in the specific table of the db.

So my question is : do I need to escape the $AccID like this GetSQLValueString($AccID, "text") just to be on the safe side, or there is no need to, since it’s not taken from a user input ?

p.s. $_SESSION['UID'] is set during the login procedure, after a successful authentication

Answer 1

Yes, you should escape it. You should not database-escape it when you put it into $_SESSION (you might want to use it for other purposes), but before inserting into the query.

Your best bet would be though to use parameterized SQL instead of always escaping and building your queries through string concatenation. Get familiar with PDO. For a better world.