note 32527 added to security.variables
| From: | manuelle_slow at yahoo dot fr | Date: | Fri, 30 May 2003 07:51:23 +0000 |
| Subject: | note 32527 added to security.variables | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-49401@lists.php.net to get a copy of this message | ||
(about security on url parameters)
Why don't you simply use a 'cast'?
like this :
$id = (int) $_POST['id'];
by this way you can be sure your variable is an integer. if $_POST['id'] contain a string,
the cast will return 0.
----
Manual Page -- http://www.php.net/manual/en/security.variables.php
Edit Note -- http://master.php.net/manage/user-notes.php?action=edit+32527
Delete Note -- http://master.php.net/manage/user-notes.php?action=delete+32527&report=yes
Reject Note -- http://master.php.net/manage/user-notes.php?action=reject+32527&report=yes