In php, can SQL injection possibly go through the is_numeric function?

Question

Can I safely assume (if I'm just GETting id number) that is_numeric is good enough to stop SQL injection attacks? or are there sql injection methods that can go through is_numeric?

Answer 1

You will be best off doing:

$id = isset($_GET['id']) ? (int) $_GET['id'] : 0;

This way you can avoid function overhead is_numeric. Any of these methods is sufficient to avoid injections, though (if you are doing something for the data, if it is_numericreturns FALSE). The ternary operator also ensures that you do not get E_NOTICE if the $ _GET variable in question does not exist.

Answer 2

, . , , , is_numeric('0xaf5') == true, , .

Answer 3

intval floatval.