Re: security/sql issues with php

From:	Chris Shiflett	Date:	Wed, 21 Sep 2005 23:21:32 +0000
Subject:	Re: security/sql issues with php
References:	1 2 3 4	Groups:	php.general
Request:	Send a blank email to php-general+get-222931@lists.php.net to get a copy of this message

Mikey wrote:

I have found that adding 0 and then running is_int() usually works.

You mean always works. :-) Casting something to an integer and then checking to see if it's an integer doesn't tell you anything useful: <?php $int = 'this is not an int'; $int += 0; if (is_int($int)) {

    echo '$int is an integer';

} ?> You're always going to see "$int is an integer" on the screen, even when $int is clearly not. As I mentioned, ctype_digit() fits the bill nicely: <?php if (ctype_digit($int)) {

    echo '$int is an integer';

} ?> You'll find that this does what you expect. Hope that helps. Chris -- Chris Shiflett Brain Bulb, The PHP Consultancy http://brainbulb.com/