Validate numbers in Codeigniter - php

Question

Here's an example with a function inside a model in my Codeigniter application.
function is_subscriber($thread_id) {
$this->db->query("SELECT user_id FROM subscriptions WHERE thread_id = $thread_id");
}
Where and how should I escape $thread_id? Since the database field thread_id is an integer $thread_id should not be surrounded by single quotes in the query. So I'm wondering how I should escape numbers in Codeigniter? Should I by my self check if $thread_id is a number, or is there a way to do it with Codeigniter?
I found escape_like_str() which escapes without adding the quotes, as opposed to escape() that adds quotes. Should I also use escape_like_str() for numbers?
Secondly, should I "validate" $thread_id in the model or in the controller?

Answer 1

The codeigniter database adapter has built-in query parameterization; it's as simple as replacing each parameter with a question mark, and passing all your variables in an array as the second argument.
$this->db->query("SELECT user_id FROM subscriptions WHERE thread_id = ?", array($thread_id));
When you set it up this way, there's no possibility of sql injection and you don't have to worry about escaping your data (at least not for the SQL portion; XSS and html escaping is still a concern)

Answer 2

Sam's way is the proper Codeigniter way to do this. For more of a standard PHP way:
$thread_id = intval($thread_id);
$this->db->query("SELECT user_id FROM subscriptions WHERE thread_id = ". $thread_id);

Answer 3

Although you have to use a query from Sam Dufel's answer, just to answer your numerous questions and assumptions
Where and how should I escape $thread_id?
A general rule is - as close to the query building as possible.
Thus, the best method would be to use a placeholder, as it will guarantee that the data will be properly formatted right before insertion into query.
Since the database field thread_id is an integer $thread_id should not be surrounded by single quotes in the query.
This is not quite true.
Only if you run mysql in strict mode, you can't use quotes.
but in general you can use quotes all the way. So, formatting numbers as strings is quite possible solution.
So I'm wondering how I should escape numbers...
The only way to escape a number is to cast it. intval() is okay
... in Codeigniter?
if it lets you to use a placeholder - go for it.
Should I by my self check if $thread_id is a number, or is there a way to do it with Codeigniter?
In gneral, there is no need to check. At the database level, only proper formatting needed.
Should I also use escape_like_str() for numbers?
It will make absolutely, definitely no sense.
Should you use a influenza vaccine to protect your money from robbery? The same here. It's different matters.
should I "validate" $thread_id in the model or in the controller?
First of all you have to distinguish input validation and database-specific formatting.
Second one is obligatory and unconditional, while first one is optional.
As long as this "validation" has nothing to do with DB formatting, you can do it anywhere.
Personally I'd do it in controller, and throw 404 on fail. Because it's controller to do HTTP specific actions, while model have to be environment-independent.
But again, such a validation has nothing to do with database-specific formatting, which have to be applied always.

Answer 4

when using a standard query you may want to use $this->db->escape_like_str() like so
$sql = 'SELECT name FROM users WHERE id = '.$this->db->escape_like_str($id).'AND user_id ='.$this->db->escape_like_str($user_id).'LIMIT 1';
Or:
$sql = 'SELECT name FROM users WHERE id = ? AND user_id = ? LIMIT 1'
$query = $this->db->query(array($id,$user_id));
This methods does not validate numbers just escapes them for security , if you want to validate a number you can use PHP native function is_numeric or ctype_digit or is_int() you can read the PHP manual or discover your self on what you need to use . .