I would like to know how secure is this? Is it going to prevent most of the sql injection attacks?
if(isset($_GET['image_id']) && is_numeric($_GET['image_id'])){
$image_id = $_GET['image_id'];
// get next picture id
$result = $pdo->prepare('SELECT image_id FROM images WHERE image_id > :image_id ORDER BY image_id ASC LIMIT 1');
if($result){
$result->execute(array(':image_id' => $image_id));
if (($row = $result->fetch()) !== FALSE) {
$next_id = $row['image_id'];
}
}
// get previous picture id
$result = $pdo->prepare('SELECT image_id FROM images WHERE image_id < :image_id ORDER BY image_id DESC LIMIT 1');
if($result){
$result->execute(array(':image_id' => $image_id));
if (($row = $result->fetch()) !== FALSE) {
$prev_id = $row['image_id'];
}
}
$result = $pdo->prepare("SELECT * FROM images WHERE image_id= ? LIMIT 1");
if ($result->execute(array($_GET['image_id'])))
{
....
On the website there is no login form or any kind of form input except may be will have just one search form but is not going to happen until I'm not sure is secured good enough. So currently I'm trying to secure this.
I've also read some articles and some questions here but still can't understand how to test my application so I'll put the source and ask you.