mysql is_numeric sql injection

Question

I have a pagination in my webpage. So I want to add a line to my query if I have a post from pagination:

$q="";
if(isset($_POST["inpi"])){
    $in = $_POST["inpi"];
    if(is_numeric($in)){
        $q = "and c.id < '$in'"; // add this to mysql
    }
    else{die("something is wrong!");}
}

So I can't use prepare statments here.

select k.user, c.id, c.from, c.sent, c.message, c.recd from chat c
inner join cadastro k on c.from=k.id
where `from`=? and `to`=? $q

notice the $q variable, it will have no value if post is empty or the and c.id < '$in'.

is it secure enought?

If you are verifying the input using is_numeric then I think you don't have to worry about sql injection in this case. Since for sql injection there must be some quotes and strings involved. — Ghulam Ali
– Ghulam Ali, Commented May 4, 2016 at 21:35
You absolutely can use prepared statements here. Are you using PDO? You can add something to the query string and the array used to hold the values at the same time. — tadman
– tadman, Commented May 4, 2016 at 21:42
PDO does make it easier, but mysqli isn't impossibly hard. — tadman
– tadman, Commented May 4, 2016 at 21:48
Here's an example of doing it with mysqli that could be adapted. — tadman
– tadman, Commented May 4, 2016 at 21:54

tadman · Accepted Answer · 2016-05-04 21:56:14Z

2

You can always accumulate arguments as you go and build it out like this:

$query = "SELECT ... WHERE `from`=? AND `to`=?";
$binds = array("ss", &$from, &$to);

if (isset($_POST["inpi"])) {
  $query .= " AND c.id < ?";

  $$binds[0] .= "i";
  $binds[] = &$_POST["inpi"];
}

$stmt = $mysqli->prepare($query);

call_user_func_array(array($stmt, 'bind_param'), $binds);

I haven't tested this, but it's based on this code and may require some adjustments to work.

PDO's execute() function takes an array straight up, it's way easier to work with.

answered May 4, 2016 at 21:56

tadman

212k23 gold badges237 silver badges266 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

RGS Over a year ago

oh, it is amazing! thank you very much for your help, friend!

Collectives™ on Stack Overflow

mysql is_numeric sql injection

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related