title: Does is_numeric() mean a var is safe for MySQL?
body: <p>Question says it all hopefully, if I check a variable returns true for is_numeric(), is it ok to put directly into the MySQL query, or do I need to apply standard escaping? I'm thinking null character, overflow exploits and stuff.</p>
  
  <p>An ambiguous example would be:</p>
  
  <pre><code>if(is_numeric($_GET['user_id'])) {
      mysql_query("SELECT * FROM `users` WHERE id = ".$_GET['user_id']);
  }
  </code></pre>
  
  <p>The datatype in MySQL is INT().</p>