我的代码sql是否可注入？ 删除管理员和普通用户在$ _GET中共享的同一页面上的用户

Question

Please view the pastebin containing my members.php file.

The idea is:

An admin & regular user view the member list on the same page....

The only difference IS the admin sees more features like the

edit | Delete | Make admin

So I suppose I was a bit dumb on parsing the deletion of a user through the url $_GET and isset

I tried to make this code anti sql injectable by redirecting a regular user and exiting the script once ?id= is ! equal to ""

if($_GET['id'] != ""){
    if (has_access($session_user_id, 1) === false) {
    header('Location: index.php');
    exit();
    }
$userID = $_GET['id'];
$sql = "DELETE FROM users WHERE user_id='".$userID."'";
$query  = mysql_query($sql);
}

Should I add in a security feature like preg which will stop the script if id= to anything but a number?

Is this even secure?

Here is the code in action on my free web host.

1334.3owl.com/members.php?id=

NOTICE, If you got to

1334.3owl.com/members.php

the id isnt set and I see an error

Notice: Undefined index: id in C:\Users\Max\Documents\xampp\htdocs\hope\members.php on line 78

Hope you guys can help me out!

NOTE: the page has the function

protect();

enabled so you need to be logged in to view the page in the first place

I created two demo accounts:

demouser
demopass

demouser2
thisisapassword

Please login then go to the link

Answer 1

Use intval():

$userID = intval($_GET['id']);

This will guarantee that $userID will be an integer so no SQL injection is possible. For added security you can should make sure that $userID is non-zero:

if (!$userID)
    die();