[Arkham_c]

I'm writing a medium sized object-oriented php app. I want to define a method that returns an object. That object is constructed via the return of a database query like

"SELECT * FROM PROPERTY WHERE PROPERTY_ID = 5"

In the example, 5 is the property ID, and it will be passed in via query string.

My concern is, how do I verify in PHP that the value passed in via query string is in fact a number?

I am concerned that someone could pass in "; DROP TABLE PROPERTY" or something equally malicious, and I want to check the input before putting it in my query.

[schk]

You can always use $variable = (int)$variable to make sure the value is an integer. If it is a text string, it will be converted to 0.

[redJag]

if(is_int($property_id)){
//execute
}
else{
echo "Error: non-numerical property ID passed";
}

[Arkham_c]

Originally posted by redJag:
if(is_int($property_id)){
//execute
}
else{
echo "Error: non-numerical property ID passed";
}

is_int -- just what I needed, thanks!

For anyone in the future, the function is documented here:

http://www.php.net/is_int

[Arkham_c]

Ok, so is_int is NOT what I needed. This code:

[php]
$somenum = "5544";
if ( is_int($somenum) )
{
echo "an int";
}
else
{
echo "not an int";
}
[/php]

will print "not an int". I found this online:

[php]
function isAnInt($x)
{
return (is_numeric($x) ? intval($x) == $x : false);
}
[/php]

[Simon Mundy]

...or you can use

"SELECT * FROM PROPERTY WHERE PROPERTY_ID = ".(INT) $property_id

...so it simply forces it to the correct type without needing conditionals.

[redJag]

Originally posted by Arkham_c:
Ok, so is_int is NOT what I needed. This code:

[php]
$somenum = "5544";
if ( is_int($somenum) )
{
echo "an int";
}
else
{
echo "not an int";
}
[/php]

will print "not an int".

That's because "5544" is a string, not an integer If you type $somenum = 5544; then it will work

[Arkham_c]

Originally posted by redJag:
That's because "5544" is a string, not an integer If you type $somenum = 5544; then it will work

Yes, but all form data comes in as a string. That's the concern.

[redJag]

Originally posted by Arkham_c:
Yes, but all form data comes in as a string. That's the concern.

OK Form was never mentioned Glad you got things as they should be!

[clam2000]

alternately you can use regular expressions
[php]
if(ereg('^[[:digit:]]+$', $property_id))) {
//execute
} else {
die("not a number");
}
[/php]
regular expresion used:
^ start of line
[:digit:] a digit, 0-9
+ one or more of whatever is within the preceding brackets
$ end of line


--will