Blind SQL injection

Question

when i use acunetix on my page i get: Blind SQL / XPath injection

header: GET / file.php? id = 2 '+ and + 31337-31337 = 0 + - + & page = 2

Answer:

no files found

(sometimes this shows the results)

here is my php code:

$id = (int) htmlentities($_GET['id']);
$fileid = mysql_real_escape_string($id);

inquiry:

SELECT * FROM `files` WHERE `id` = '".$fileid."'

what am I doing wrong? can someone delete my database with this? im also receives the same message on some requests almost equal to this, but which also have a limit of 0.1

I use paginator (I fixed some injections where in this script), but in the example I did not use it

Answer 1

Listing id on int should already prevent any chances of SQL injection attacks (as far as I know).

$id = (int) $_GET["id"];
$Query = "SELECT * FROM files WHERE id = $id;";

file.php? id = abcabc $id = 0, , id, $id ( SQL) - .

, .

Answer 2

, Acunetix , , - SQL- .