Validate SQL injection

[lucthienphong1120]

Validate SQL injection by Data Type Validation

$query="select * from users where id=".$_GET['id'];
$rs=mysqli_query($db,$query);

Fix SQL injection by Using Prepared Statements

$q = "%".$_GET['q']."%";
$query="select * from toys where name like ? or description like ?";
$stmt = mysqli_prepare($db, $query);
mysqli_stmt_bind_param($stmt, 'ss', $q, $q);
mysqli_stmt_execute($stmt);
$rs=mysqli_stmt_get_result($stmt);