in php can an sql injection possibly make it through is_numeric function?

Question

could i safely assume (if i'm just GETting an id number) that is_numeric is good enough to thwart sql injection attacks? or is there sql injection methods that can pass through is_numeric?

Answer 1

You'd be better served to just do:

$id = isset($_GET['id']) ? (int) $_GET['id'] : 0;

This way you can avoid the is_numeric function overhead. Either method is sufficient to avoid injection, though (as long as you do something to the data if is_numeric returns FALSE). The ternary operator also makes sure you don't get an E_NOTICE if the $_GET variable in question doesn't exist.

Answer 2

No, there isn't. However, remind, that for example is_numeric('0xaf5') == true, thus its maybe not enough according what you want to achieve.