note 117552 deleted from function.is-numeric by crell
| From: | crell@php.net | Date: | Mon, 18 Apr 2022 14:51:40 +0000 |
| Subject: | note 117552 deleted from function.is-numeric by crell | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-218265@lists.php.net to get a copy of this message | ||
Note Submitter: Tim Robert-Fitzgerald
----
Be careful when using
is_numeric() to validate user input and protect against SQL
injection. According to wiki.hashphp.org,
"Many people reach for is_numeric() thinking this is a good approach, and it will seem to work
just fine. However the problem with is_numeric() isn't that it can't detect an integer, it
is that it detects a lot more than just integers. All of the following are valid numbers to
is_numeric():
- 1
- 1.123
- 0xFF
- +0123.45e6
See the problem? If we really want just an integer, this function is too broad."
Source: http://wiki.hashphp.org/Validation#Why_is_numeric.28.29_is_bad