I've a php code where I get the page number from a GET request and then run a sql query to select records from the database by the page number
$maxPerPage = 20; $page = $_GET["p"]; $applicants = DB::query('SELECT * FROM registrees ORDER BY id DESC LIMIT '.$page*$maxPerPage.','.$maxPerPage);
My question is can someone inject an SQL query in this code ? and if it could happen, I need examples of the sql-injection that can run here.
The problem here that the
$page is multiplied with
$maxPerPage if I tried to add any string in
$page php will throw this error
A non-numeric value encountered.
Any ideas ?