Counting MySQL rows, stopping people from entering characters

I was wondering how I could stop people from doing this; blahblah.com/index.php?id=../../file.开发者_开发技巧php

I was told I could stop this from happening by counting mysql rows...?

you can simply use PHPs is_numeric on $_GET['id'], or force the id to a number

You can check first if it's a numeric value like Nayena said, then you can use a MySQL request to check the row count on this id. If it's 1, then it's valid, otherwise there is a problem in the request

EDIT (Example) :

<?php
if(is_numeric($_GET['id']))
{
    $id = $_GET['id'];
    $count = mysql_result(mysql_query("SELECT COUNT(*) FROM table WHERE id=".$id));
    if($count == 1)
    {
        //Id is valid, moving on...
    }
    elseif($count == 0)
    {
        //Id doesn't exist, display error message
    }
    else
    {
        //Id exists more than 1 time, meaning there is a serious issue.
        //Display error message or send email to webmaster
    }
}
else
{
    //Display error message (incorrect format for example)
}
?>

You can do the following:

<?php
$id = isset($_GET['id']) ? (int)$_GET['id'] : false;

if ($id) {
    // do your thing..
} else {
    echo 'invalid item..';
}

IF $_GET['id'] isn't set, or it's 0 then "invalid item" will be displayed. The (int) will also cast strings to 0.

Another solution:

<?php
$id = isset($_GET['id']) ? $_GET['id'] : false;

if ($id && is_numeric($id)) {
    // run mysql query here
} else {
    echo 'Invalid item..';
}