mysql_real_escape_string does it allow no quotes within a sql query?
<p>Is this code buggy? </p>

<pre><code>&lt;?php

if (isset($_GET['Submit'])) {

    // Retrieve data

    $id = $_GET['id'];
    $id = mysql_real_escape_string($id);

    $getid = "SELECT first_name, last_name FROM users WHERE user_id = $id";

    $result = mysql_query($getid) or die('&lt;pre&gt;' . mysql_error() . '&lt;/pre&gt;' );

    $num = mysql_numrows($result);

    $i=0;

    while ($i &lt; $num) {

        $first = mysql_result($result,$i,"first_name");
        $last = mysql_result($result,$i,"last_name");

        echo '&lt;pre&gt;';
        echo 'ID: ' . $id . '&lt;br&gt;First name: ' . $first . '&lt;br&gt;Surname: ' . $last;
        echo '&lt;/pre&gt;';

        $i++;
    }
}
?&gt;
</code></pre>

<p>Despite the fact that it uses mysql_real_escape_string , an attacker can still inject code without quotes.</p>

<p>It's part of DVWA vulnerable web application. </p>

<p>Does the function mysql_real_escape_string() blocks quotes but to me it seems to be allowing no quotes at all...</p>

<p>Am I correct?</p>
