sql注入字符型与数字型

数字型
<?php
$id =$_GET[‘id’];
$conn=mysql_connect(‘localhost’,’root’,’root’);
mysql_select_db(‘admin’,$conn);
$sql=”SELECTFROM USER WHERE id=’$id’”; //区别在是否单引号包裹
$result=mysql_query($sql) or die(mysql_error());
while($row=mysql_fetch_array($result)){
echo “ID:”.$row[‘id’].”
“;
echo “USENAME:”.$row[‘usename’].”
“;
echo “PASSWORD:”.$row[‘password’].”
“;
echo “EMAIL:”.$row[‘email’].”
“;
}
mysql_close($conn);
echo”