Question

Some may know that PHP methods can be remotely invoked from Flash.
Sometimes the input parameter of a remote PHP method is an array of integers.
Because PHP is dynamically typed an attacker can pass an array of anything.
The array of integers has to be used in a SQL query.
At the moment I’m preventing injection like this:

foreach ($unsafeArray as $value)
    $safeArray[] = (int)$value;

What would you recommend? Maybe I should start using Java 😀

Answer 1

You could use this: $aSafeArray = array_map('intval', $aUnsafeArray); to make sure all passed values are an integer.

My advice would be to start using prepared statements!
Example:

$o->bindParam(':anint', $iInt, PDO::PARAM_INT);