Why is request bypassing NULL check? - php

Question

I have our users click an activation link via email when they sign up for our site. The link looks like http://www.site.com/?u=123&a=xyz.
When the user hits the link, my code parses the $_GET["u"] and $_GET["a"] params. The code makes sure there is nothing malicious and what not. This code also checks to see if $_GET["u"] is set and defined. If it's empty, it's spits out an error message.
if(isset($_GET["u"]) && ($_GET["u"] !== "") && is_numeric($_GET["u"]) {
// proceed to function
$u = clean_it($_GET["u"]);
} else {
// show error screen
}
If these params ARE NOT empty, they are then sent to a function to check the values against the db.
My check, within this function, is:
if($u === NULL) {
return FALSE;
} else {
// check $u against the db
$sql = "SELECT * FROM users WHERE user_id=$u LIMIT 1;";
}
So when requests comes in, it's going immediately to the function and hitting the sql call. My queries, from these requests, are looking like:
SELECT * FROM users WHERE user_id=NULL LIMIT 1;
Why is this happening? Any ideas? $_GET["u"] is definitely being set (I can see it in the referer). This problem does not always occur; it's pretty random. Maybe 2-3 out of ~140 new accounts per day.

Answer 1

If it happens just sometimes, personally, I would replace those $u === NULL by empty($u). I think you are simply trying to check that you have a value in there.
if(!empty($_GET['u']) && is_numeric($_GET["u"]) {
// proceed to function
$u = clean_it($_GET["u"]);
} else {
// show error screen
}
if(empty($u)) {
return FALSE;
} else {
// check $u against the db
$sql = "SELECT * FROM users WHERE user_id=$u LIMIT 1;";
}
Of course since you only gave fragments of code it could be that your variable gets erased somewhere else we don't see.
On a side note - building your query like this is a bad idea. Research PHP's PDO.