Wonderful little PHP problem.

[Muel]

Hi there, I'm using this little bit of code:

$id = $_REQUEST['id'];
$id = mysql_real_escape_string($id);
echo $id;

The $id just contains a number, in fact any number that I care to put into it, but for some reason when the 2nd isn't commented out, it empties the variable?

I've paired the script right down so that is literally all that is left PHP wise.

If I remove the 2nd line, it displays whatever is in the $id. If I change mysql_real_escape_string to strip_slashes, then it works. :s

Just wondering if anyone can help? I've got to be missing something, I've never had a problem like this before.

 

[Dynix]

Are you actually using mysql_connect anywhere, or are you simply just calling mysql_real_escape_string? You haven't said what the script is so my next sentence is based on an assumption!

You're only meant to use mysql_real_escape_string when interacting with a database. It'll throw an error if you aren't (or not if you don't display errors or are supressing the errors), which is why you're not getting anything.

 

[Moredhel]

$id = filter_input(INPUT_GET, 'id', FILTER_VALIDATE_INT);
echo $id;

 

[rickh]

or even easier:

$id = (int)$_GET['var'];
echo $id;

 

[Muel]

Cheers guys but the duy in the first post had it! I have a require_once() that has all the connection data and the link was broken.

 

[robmiller]

or even easier:

$id = (int)$_GET['var'];
echo $id;

Though using filter_input is a good habit to get in to, given the ease with which you can validate URLs, emails, etc.