6 ms·
why not using filter_input or casting it ? e.g $userId = (int)$_GET["userId"]; and also when query to db using parameter binding ?
by alien3d 10y ago
why not using filter_input or casting it ? e.g $userId = (int)$_GET["userId"];
and also when query to db using parameter binding ?
- Grazester 10y agoYeah, a prepared statement would take care of this just fine
- deleted 10y ago[deleted]