Question

Is this the right way to use mysql_real_escape_string? I was using $GET but a friend told me to make it safer with real_escape_string:

$id = intval($_GET['id']);

$result = mysql_query("SELECT * 
                         FROM products 
                        WHERE id = $id") or die("err0r");

if(!$result) mysql_real_escape_string($id); {

Answer 1

No, you normally use mysql_real_escape_string to prepare variables for use in a query, but in your case:

1. you already use intval;
2. you use it in the wrong place.

You don’t need it in your example.