title: need help on sql injection attack
body: <p>Checking my web site with google webmaster tools I found a strange thing :</p>
  
  <p>somebody tried to use to link to my site using this (I change the real name of my site for obvious security reasons ) :</p>
  
  <pre><code>....://mysite.com/tarifs.php?annee=aaatoseihmt&amp;mois=10&amp;cours=1828
  </code></pre>
  
  <p>I try it and understand it was a sql injection with the results :</p>
  
  <blockquote>
    <p>Warning: mktime() expects parameter 6 to be long, string given in
    /home/..../public_html/..../tarifs.php
    on line 72</p>
  </blockquote>
  
  <p>my code line 72 is :</p>
  
  <pre><code>mktime (0, 0, 0, $mois, "01", $annee)
  </code></pre>
  
  <p>part of this:</p>
  
  <pre><code>&lt;?php
  include ("include.php");
  
  if (!$link = mysql_connect($host, $user, $pass)) {
      echo "Could not connect to mysql";
      exit;
  }
  
  if (!mysql_select_db($bdd, $link)) {
      echo "Could not select database";
      exit;
  }
  
  mysql_query("SET NAMES 'utf8'");
  
  $annee = "";
  $mois = "";
  $stage = "";
  
  if (isset($_GET['annee'])) {$annee=$_GET['annee'];}
  if (isset($_GET['mois'])) {$mois=$_GET['mois'];}
  if (isset($_GET['stage'])) {$stage=$_GET['stage'];}
  
  if($annee == "")
  {
  
      $annee = date("Y");
  }
  
  if($mois == "")
  {
  
      $mois = date("m");
  }
  
  
  $date_du_jour = date("d")."-".date("m")."-".date("Y");
  
  if($mois == "12")
  {
      $mois_precedent = "11";
      $mois_suivant = "01";
      $annee_mois_precedent = $annee;
      $annee_mois_suivant = $annee + 1;
  }
  elseif($mois == "01")
  {
      $mois_precedent = "12";
      $mois_suivant = "02";
      $annee_mois_precedent = $annee - 1;
      $annee_mois_suivant = $annee;
  }
  else
  {
      $mois_precedent = sprintf("%02s", $mois-1);
      $mois_suivant = sprintf("%02s", $mois+1);
      $annee_mois_precedent = $annee;
      $annee_mois_suivant = $annee;
  }
  
  
  $jour_en_cours = date("d");
  
  $mois_francais = array("Janvier", "Février", "Mars", "Avril", "Mai", "Juin", "Juillet", "Août", "Septembre", "Octobre", "Novembre", "Décembre");
  
  $dt_deb_genere = $annee."-".$mois."-01";
  $dt_fin_genere = $annee_mois_suivant."-".$mois_suivant."-01";
  
  $dt_date = mktime (0, 0, 0, $mois, "01", $annee);
  $jour_de_la_semaine = date("w", $dt_date);
  ?&gt;
  </code></pre>
  
  <p>what can I do to protect my site against this ?</p>
  
  <p>I tried to understand how to it with "similar question" but I think I am to new to php and mysql to be able to understand.So any help is really great !</p>
  
  <p>Thanks if you can help on this ! I worked hard for months now on my site and don't want to lose my business.</p>
  
  <p>.blc.</p>
  
  <hr>
  
  <p>THEN !!! I have made few little change after the code provided by Lucanos (THANKS !!!!) :-) :</p>
  
  <pre><code>&lt;?php
  include ("include.php");
  
  if (!$link = mysql_connect($host, $user, $pass)) {
      echo "Could not connect to mysql";
  exit;
  }
  
  if (!mysql_select_db($bdd, $link)) {
  echo "Could not select database";
  exit;
  }
  
  mysql_query("SET NAMES 'utf8'");
  
  $annee = '';
  $mois = '';
  $stage = '';
  
  if( isset( $_GET['annee'] ) )
  {
  $annee = preg_replace( '/\D/' , '' , $_GET['annee'] );
  if( !$annee || !( $annee&lt;=2015 &amp;&amp; $annee&gt;=2013 ) )
  // Allows you to set an expected range for this value
  // code here expects a number between 2013 and 2015 inclusive
  $annee = '';
  }
  
  if( isset( $_GET['mois'] ) )
  {
  $mois = preg_replace( '/\D/' , '' , $_GET['mois'] );
  if( !$mois || !( $mois&lt;=12 &amp;&amp; $mois&gt;=1 ) )
  // I assume this is the Month, with a range of 1 to 12
  $mois = '';
  }
  
  if (isset($_GET['stage'])) {$stage=$_GET['stage'];}
  
  if($annee == '')
  {
  // Récupération de l'année en cours
  $annee = date('Y');
  }
  
  if($mois == '')
  {
  // Récupération du mois en cours
  $mois = date('m');
  }
  
  // Récupération de la date du jour
  
  $date_du_jour = date( 'd-m-Y' );
  
  if($mois == '12')
  {
  $mois_precedent = '11';
  $mois_suivant = '01';
  $annee_mois_precedent = $annee;
  $annee_mois_suivant = $annee + 1;
  }
  elseif($mois == '01')
  {
  $mois_precedent = '12';
  $mois_suivant = '02';
  $annee_mois_precedent = $annee - 1;
  $annee_mois_suivant = $annee;
  }
  else
  {
  $mois_precedent = sprintf('%02s', $mois-1);
  $mois_suivant = sprintf('%02s', $mois+1);
  $annee_mois_precedent = $annee;
  $annee_mois_suivant = $annee;
  }
  
  // Récupération du jours en cours
  $jour_en_cours = date('d');
  
  $mois_francais = array(
  'Janvier' , 'Février' , 'Mars' ,
  'Avril' , 'Mai' , 'Juin' ,
  'Juillet' , 'Août' , 'Septembre' ,
  'Octobre' , 'Novembre' , 'Décembre'
  );
  
  $dt_deb_genere = "{$annee}-{$mois}-01";
  $dt_fin_genere = "{$annee_mois_suivant}-{$mois_suivant}-01";
  
  $dt_date = mktime( 0 , 0 , 0 , $mois*1 , 1 , $annee*1 );
  $jour_de_la_semaine = date( 'w' , $dt_date );
  ?&gt;
  </code></pre>
  
  <p>tried (with no success until now) to add a condition testing if "stage" exist in data base to avoid a call like stage=200 which do not exist ans display an empty calendar in the page. But in final I miss something here (I didn't include it in the past code )</p>
  
  <pre><code>$sql_stage = "select * from data where type_data = 'STAGE' and ind_valide = 1 and ind_etat = 1 order by sous_titre, id_type_1, ordre";
  $result_stage = mysql_query($sql_stage, $link);
  $existingstage = '';
  
  
  while ($row_stage = mysql_fetch_array($result_stage))
  {
  $existingstage = $row_stage["id_data"];
  
  if( isset( $_GET['stage'] ) )
  {
      $stage = preg_replace( '/\D/' , '' , $_GET['stage'] );
  
      if( !$stage || !( $stage= $existingstage ) )
  
      $stage = '';
  }
  }
  </code></pre>