title: Why is this SQL code insecure?
body: <p>I just had a friend of mine look over some code I'm using to get data from my database, and he tells me it's very unsecure and that SQL injection is serious shit.</p>
  
  <p>Here's the code I'm using now:</p>
  
  <pre><code>$id = $_GET['id'];
  $result = mysql_query("SELECT * FROM news WHERE id = $id") or die("err0r");
  </code></pre>
  
  <p>He tells me that the solution is to change that code into:</p>
  
  <pre><code>$id = intval($_GET['id']);
  $result = mysql_query("SELECT * FROM news WHERE id = $id") or die("err0r");
  </code></pre>
  
  <p>My code somehow (according to my friend) makes any user able to edit content in my database:</p>
  
  <pre><code>http://mydomain.com/?p=news&amp;id=38;DROP TABLE tablename;
  </code></pre>
  
  <p>Could someone explain exactly what he means?</p>
  
  <p>Thank you and have a pleasant day</p>