是否有必要将mysqli_real_escape_string与来自<input type = number>输入的数据一起使用？ [重复]

Question

This question already has an answer here:

• Do I have to guard against SQL injection if I used a dropdown? 11 answers

Just as the title states. Is it a standard procedure/practice to escape number inputs?

I know text fields should be escaped, but i'm wondering if I need to escape numbers.

</div>

Answer 1

You should use Prepared Statement. But if you don't wish to do that, at least cast some data type, for example:

<?php
$myVar = (int)$_POST['user_age'];
$myVar = (float)$_POST['user_salary'];