OK consider this url:
example.com/single.php?id=21424
It's pretty obvious to you and i that the PHP is going to take the id and run it through a mysql query to retrieve 1 record to display it on the page.
Is there anyway some malicious hacker could mess this url up and pose a security threat to my application/mysql DB?
Thanks
Of course, never ever ever consider a user entry (_GET, _POST, _COOKIE, etc) as safe.
Use mysql_real_escape_string php function to sanitize your variables: http://php.net/manual/en/function.mysql-real-escape-string.php
About SQL injections : http://en.wikipedia.org/wiki/SQL_injection
All depends on the filtering you explicitely (with filter_var() for instance) or implictely (by using prepared statements for instance) use.
Well there is Sql injection http://en.wikipedia.org/wiki/SQL_injection
来源：https://stackoverflow.com/questions/5089549/php-protection-of-get-parameters