mysql_real_escape_string help!!

[fireblade]

hi,
There is a php function mysql_real_escape_string() that we can use to clean string variable before put in to sql query. I am afraid is there any other that can I use with Integer types or the same I should use for all type? Can any one explain this please..

[Mindzai]

Escaping something other than a string is not possible, there is no such thing as escaping an integer. If you want to clean/validate integers, you can either just cast to int to be sure of the type:

$foo = (int) $foo; 

or else check it is int and do soemthing different if it is not:

if (!is_int($foo) {
    // not an int
} 

[fireblade]

thanks,
btw, I think I could not explain the question correctly. I want this..

$sql = "INSERT INTO %s(id, agg_number, app_date, inv_number, account_type, status) VALUES (%d, '%s', '%s', '%s', '%d', '%s')";
        $sql = sprintf($sql, $this->tableName,
                            $this->id, 
                            $this->agg_number, 
                            $this->getApp_date()) 
                            $this->getInv_number(), 
                            mysql_real_escape_string($this->getAccount_type()),
                            mysql_real_escape_string($this->getStatus())); 

This function is escaping the given data for string type and prapare it for insertion. So we can insert this data in to any mysql String Types. Same like there are Numeric Types and Date & Time Types. You might have looked in ADO.NET, there is parameter collection where we can define the data as DBTYPE.INT, DBTYPE.BIT so on before insertion. I was guessing is there any function that can do this job.

[Mindzai]

If I'm understanding correctly, you can cast a variable to any type:

(int) $foo;
(bool) $foo;
(string) $foo; 

etc, although PHP is a loosely typed language and as a rule this is not usually necessary.

[fireblade]

Yes mindzai. That is what I wanted to confirm whether is there any other option or to go as usual. thanks for your replies.