sanitizing/security
| From: | Sebastian | Date: | Sun, 19 Dec 2004 03:50:17 +0000 |
| Subject: | sanitizing/security | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-204669@lists.php.net to get a copy of this message | ||
just a question, what is the best way to sanitize your scripts when you're
using $_GET or $_REQUEST in a query?
eg, i usually just do:
if(is_numeric($_REQUEST['id']))
{
mysql_query("SELECT id FROM table WHERE
id=".intval($_REQUEST['id'])."");
}
what about when the GET is text? just use htmlspecialchars?
just looking for some advice to help keep my apps secure.
cheers