PHPize Online / SQLize Online  /  SQLtest Online

<?php $employee_id = '1'; $employee_id = explode(' ', $employee_id)[0]; $query = 'SELECT name FROM Employees WHERE id = CAST('.$employee_id.' AS INT)'; $stmt = $pdo->prepare($query); $stmt->execute(); $rows = $stmt->fetchAll(PDO::FETCH_ASSOC); var_dump($rows); echo PHP_EOL; $employee_id = '1/**/AS/**/INT)/**/OR/**/1=1/**/--'; #$employee_id = "1"; $employee_id = explode(' ', $employee_id)[0]; $query = 'SELECT name FROM Employees WHERE id = CAST('.$employee_id.' AS INT)'; echo $query.PHP_EOL; $stmt = $pdo->prepare($query); $stmt->execute(); $rows = $stmt->fetchAll(PDO::FETCH_ASSOC); var_dump($rows);