real_escape() is a function which needs memory for its functionality, so I was wondering if there was any necessity to do that if we've already cast it?
$num = (int) $num;
Can we use
real_escape() just for string parameters?
It's true that casting can mitigate SQL injections, but unless performance is a huge concern for you, I'd use
At the very least, if you're going to rely on a cast to implement security, I'd leave some very conspicious ALL CAPS comments in your code to make it clear that that's what you're doing.
You are right. If you know it is an
P.S. I'll go out on a limb and express an opinion. For most purposes, prepared statements are a better defense against SQL injection than manually applying escaping functions. (I'm sure there are PHP folks somewhere who will give me a hard time about this, or point out that some database systems on PHP don't support prepared statements.)
In this example - if you cast variable - there is no need to do any other sanitization. But remember that casting must be prepared on the PHP-level. Don't even think about casting in your SQL query!
This one leads to Blind SQL Injection: