|
Still not really secure, youve just thrown in a auto convert of the _GET and _POST to local vars which will still be incorrect as you clean then once with
get_magic_quotes_gpc() check
then use the initial raw data to do the mysql_real_escape_string() clean.
But then, if the value is an integer, its not cleaned at all, so the raw data is still flowing through.
Make use of (int) or intval() if you know the variable you want HAS to be an integer.
|