Should I avoid the expected integer value with mysql_real_escape_string or can I just use (int) $ expectedinteger

Question

is it safe to use cast (int) instead of escaping?

class opinion { function loadbyopinionid($opinionid){ $opinionid=(int)$opinionid; mysql_query("select * from fe_opinion where opinionid=$opinionid"); //more code } } 

Answer 1

mysql_real_scape_string for STRINGS . it will not make the whole "safe" to use. eg.

 $safe = mysql_real_escape_string($_GET['page']); 

will do nothing where

 $_GET['page'] = "0 = 0"; 

because there are no SQL metacharacters. your request will be in something like

 SELECT ... WHERE somefield = 0 = 0 

However, if intval () converts this value 0=0 to regular 0 .

Answer 2

Yes, it's safe, but you should avoid the value in the query .. Where Opinid = '$ opinionid' "

BTW (1) Never use Select * Solution Select a field, field2 ....

(2) (int) $ foo is less than permanent, and then intval ($ foo)