note 107222 deleted from function.is-numeric by crell
| From: | crell@php.net | Date: | Mon, 18 Apr 2022 14:52:35 +0000 |
| Subject: | note 107222 deleted from function.is-numeric by crell | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-218267@lists.php.net to get a copy of this message | ||
Note Submitter: akam at akameng dor com
----
<?php
$d = @$_GET['d'];
/*
assuming that passing value of d in the mysql
$sql = "select * from books where bookid = '$d' "
*/
/*
now check if $d is numeric?
*/
if(!is_numeric($d)){
$d = preg_replace("/[^0-9]+/", "", $d);
}
echo "Cleared value: $d \n<br />Original Vlaue:".@$_GET['d'];
//then using clear value of $d in the mysql query
$sql = "select * from books where bookid = '$d' ";
?>
Example:
?d=52;d;s;s'2233l'[[22
Outpt:
Cleared value: 52223322
Original Vlaue:52;d;s;s'2233l'[[22