SQL Injection

[Jo]

Wäre dann so was o.k.?

  
  function GetSQLValueString($theValue, $theType) {  
    $theValue = (get_magic_quotes_gpc()) ? stripslashes($theValue) : $theValue;  
    switch ($theType) {  
      case 'text':  
        $theValue = pg_escape_string($theValue);  
        break;  
      case 'int':  
        $theValue = intval($theValue);  
        break;  
      case 'double':  
		$theValue = str_replace(',', '.', $theValue);  
		$theValue = floatval($theValue);  
        break;  
    }  
    return $theValue;  
  }  
  
# URL Variable  
if (empty($_GET['id'])) {  
	echo "parameter fehlt: <i>id</i>";  
	exit;  
} else {  
	$id = GetSQLValueString($_GET['id'],"int");  
}  
  

Gruß
Jo