How to correctly pass a variable to a database query?

Question

PHP

For sampling, you need to pass the value of the ID variable. What is the safest way to do this?

$id = $_GET["id"];

$res = $mysqli->query("SELECT * FROM goods WHERE id = '$id'");

Answer 1

Use prepared expressions with placeholders.

Answer 2

If you write something of your own and you need to use the base, then in order not to invent a bicycle with PDO, I use the RedBeanPHP ORM, it is this ORM that has proven itself well. Easy to use, good documentation and quite fast

Answer 3

If you are learning, then immediately forget about the existence of mysql(i), and master PDO. Use parameter binding and prepared expressions. And never use variables in the query text...
If for some reason, this is some kind of legacy code that cannot be rewritten and you must use mysqli, then at least check the type and value of id, for example, using filter_var ($id, FILTER_VALIDATE_INT). Or in another suitable way. Attention: not is_int(), because $_GET["id"] is a string...