Is (int) and is_int () safe for protection against SQL injection?

Question

So, I was wondering if this is enough to be sure that the user will not make any SQL injections, and the number will be always and only integer? The $ id function in the getArticle function is bound to the SQL query.

<?php $id = (isset($_GET['id']) && is_int((int)$_GET['id'])) ? (int)$_GET['id'] : false ?> <?php $news = $class->getArticle($id) ?> 

As far as I tested, it worked fine, but since I'm not quite sure, I rather ask you, man! Well, people say prepared statements will do the trick. Would they really be? For example, can I be absolutely sure that if the binding parameter is an integer, will it be an integer larger?

Thanks in advance!

Answer 1

You can simply type them with the appropriate type:

 $number = intval($_GET['id']); $string = mysql_real_escape_string(strval($_GET['str'])); 

To make sure you get what you expect.

The best solution is to use prepared statements to avoid sql injection.

Answer 2

Use prepared statements. There is no reason to NOT use them. Then you do not need to ask: "Is it good enough?"

Answer 3

I can not imagine how this can be used for SQL-Injection. Therefore, I would say that it is quite safe.

Answer 4

just use:

 $id=(int)@$_GET['id']; 

if $ _GET ['id'] is not set, $ id will be 0.
if you want to check if the identifier is set correctly:

 if ($id=(int)@$_GET['id']){ // } else { //invalid id }