Considerations for using the Is_numberic function in PHP

0x00 Introduction

Some of the domestic CMS program has been useful to the Is_numberic function, we first look at the structure of this function

BOOL Is_numeric (mixed $var)

It is important that is_numeric determine whether a string is a numeric type. For example-1, 1.5 This type of number in Is_numberic is returned true because it is a numeric type

Whether the 0X01 function is secure

Let's take a look at an example to show whether the function is secure.

The code is as follows	Copy Code
$s = is_numeric ($_get[' s ']) $_get[' s ']:0; $sql = "INSERT into test (type) values ($s);"; is values ($s) is not values (' $s ') mysql_query ($sql);

The above fragment program is to determine whether the parameter S is a number, is to return the number, not to return 0, and then bring into the database query. (This will not construct the SQL statement)
We convert ' 1 or 1 ' to the value of the s parameter of the 16 0x31206f722031

After the program runs, we query the database to see the following figure:

If you requery the field of this table, and do not filter into another SQL statement, it will result in 2 injections.

0x02 Summary

Try not to use this function, if you want to use this function, it is recommended to use the canonical SQL statement, the condition of the single quotation mark, so that the 16 0x31206f722031 will be displayed in the database. The 1 or 1 will not appear.

If we want to judge whether it is a number we can use the intval () function instead of the is_numeric function so that the above method is invalid, the following example

code is as follows

copy code

$id = Intval ($_get[' id ']); Echo intval// Echo intval (4.2);//4 Echo intval (' n ');//km Echo intval (' +42 ');//The Echo I Ntval ('-42 '); -42 Echo intval (042);//1e10 Echo intval (' 042 ');//The Echo intval ();//1410065408 Echo intval (' 1e1 0 '); 1 Echo intval (0x1A);//- Echo intval (42000000);//42000000 Echo intval (420000000000000000000);//0 echo intval (' 420000000000000000000 '); 2147483647 Echo intval (8);// Echo intval (' n ', 8);//

The most common use of

Intval is in the process of filtering the data into the database, converting it to an integral type, avoiding the occurrence of SQL injection attack