I found an SQLi in a buddies work site. He reported it to his superiors and they allowed me to run additional tests and also patch the site. After reviewing the site, The vulnerable code was a $_GET. I simply added intval() to check the variable if it was an integer. I reran sqlmap, w3af, and a few other scanners. The holes seemed to have been patched. Was this the proper patch? If not, how do I properly secure a $_GET in PHP?
It doesn't matter if its $_GET, $_POST, $_REQUEST, $_FILE or even $_SERVER. Its all user input and a there for a potential source of an attack. What matters is how the user input is being used. In the case of SQL Injection, casting it to an int, such as
intval() works well. However, you should be using parameterized queries with a library like sqli, adodb, or pdo.