note 80038 deleted from function.mysql-real-escape-string by danbrown

Note Submitter: Michael D - DigitalGemstones.com ---- Unless I'm mistaken, the third example is a /very/ poor example. The code: // Make a safe query $query = sprintf("INSERT INTO products (name, description, user_id) VALUES ('%s', '%s', %d)", mysql_real_escape_string($product_name, $link), mysql_real_escape_string($product_description, $link), $_POST['user_id']); does not in any way secure $_POST['user_id'] from a malicious attack. It's very simple to secure against this, simple append (int) to $_POST['user_id'] (since it's a numerical value, anything other than a number will be converted to zero, and thus keep the system secure). That said, it would probably be wise to either check for a valid user before this query, or not using $_POST values to get the current user, since a 0 in your database for a user ID will create errors in your database, even if there aren't any security flaws.