note 42571 deleted from function.mysql-escape-string by nlopess
| From: | nlopess@php.net | Date: | Sat, 22 May 2004 08:18:30 +0000 |
| Subject: | note 42571 deleted from function.mysql-escape-string by nlopess | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-69942@lists.php.net to get a copy of this message | ||
Note Submitter: arcticdoom@!Spam&Die!pixelsaredead.com
----
Or, for that matter, you could just explicitly cast things you know should be numeric. For example,
adding zero to a value will cast it as a number:
<?php
$input = "15 OR 1=1";
echo "Input Before Cleaning: $input\\n"; // shows "15 OR 1=1"
// Uh-oh! User 15 is being evil!
$input += 0;
echo "Input after cleaning: $input"; // shows "15"
// Not this time, user 15. Muahahahahah!!!
?>