A newbie question here.
I've just read through a short introduction to SQL injection on http://www.breakthesecurity.com/2010/12/hacking-website-using-sql-injection.html?m=1
It says to find a GET request path on a PHP application to see if it is vulnerable or not.
I have a website, with the following query URL.
I'm using a raw query, so according to the site, I'm assuming that my website IS vulnerable to SQL injection.
To test this, I try this.
(adding a single quotation mark after limit=50)
This prints out the error - as expected and as the website has suggested - meaning that my query is vulnerable.
Now, to safe-guard this, I want to make sure I "escape" the quotes in my queries. I'm using a PHP framework called CodeIgniter, in which there is a function called
So I use this "escape" function on the value 50, but now it returns an error saying that "50" is not a valid integer.
Fair enough, the "LIMIT" condition should only receive an integer value.
But my question is, is my query now "SQL-injection" safe?