PHP Validation (SQL) and Redirection - php

Question

I am getting a value "ID" from the URL using GET, as follows -
if ( isset($_GET['id']) && (filter_var($_GET['id'], FILTER_VALIDATE_INT))) {
$colname = $_GET['id'];
}
else
{
$URL="/index.php";
header ("Location: $URL");
exit();
}
I am then checking if the element of that ID exists in the table, as follows -
$query_validate = sprintf("SELECT * from surveys where id = %s", GetSQLValueString($colname, "int"));
$result_validate = mysql_query($query_validate, $conn) or die(mysql_error());
$row_validate = mysql_fetch_assoc($result_validate);
$num_validate = mysql_num_rows($row_validate);
if($num_validate==0)
{
$URL="/index.php";
header ("Location: $URL");
exit;
}
The idea is that when I type in the url as http://example.com/surveys?id=1, it loads the first survey, and so on. If an invalid ID (alphabets, id does not exist in the table, etc) is entered, it should redirect the user back to index.php, this is the basic premise of my code.
However, even if I go to the URL http://example.com/surveys?id=abc, it loads the page and displays an SQL Syntax error. I know that the header function cannot be invoked after output has been given on to the page, but these 2 checks happen very close to the start and I have ensured there is no output happening there.

Answer 1

Try this,
$num_validate = mysql_num_rows($result_validate);
Instead of
$num_validate = mysql_num_rows($row_validate);
Code:
$query_validate = sprintf("SELECT * from surveys where id = %s", GetSQLValueString($colname, "int"));
$result_validate = mysql_query($query_validate, $conn) or die(mysql_error());
$num_validate = mysql_num_rows($result_validate);
if($num_validate==0)
{
$URL="/index.php";
header ("Location: $URL");
exit;
}else{
$row_validate = mysql_fetch_assoc($result_validate);
}