Question

is it safe to use cast (int) instead of escaping?

class opinion
{
   function loadbyopinionid($opinionid){
      $opinionid=(int)$opinionid;
      mysql_query("select * from fe_opinion where opinionid=$opinionid");
      //more code 
   }
}

Answer 1

mysql_real_scape_string is for STRINGS. it will not make an integer ‘safe’ for use. e.g.

$safe = mysql_real_escape_string($_GET['page']);

will do NOTHING where

$_GET['page'] = "0 = 0";

because there’s no SQL metacharacters in there. your query would end up something like

SELECT ... WHERE somefield = 0 = 0

However, doing intval() will convert that 0=0 into a plain 0.