mysql automatically cast strings to integer

Question

I\'ve just noticed that if I do a MySQL request like this one:

SELECT 1 FROM myTable WHERE id = \'asdf\'

Then the string \'asdf\' is casted

Answer 1

You must first sanitize your inputs via PHP.

$id = 'asdf';
if(is_numeric($id)){
    $query("SELECT 1 FROM myTable WHERE id = $id");
}else{
    die("ID is not numeric");
}

Or you can do:

    SELECT 1 FROM myTable WHERE id = 'asdf' AND 'asdf' REGEXP '^-?[0-9]+$'

This would cause the regex to = false, causing no rows to return.