title: How to prevent MySQL sleep injections?
body: <p>Recently one hacker tried to slow my website using sleep injection. Although we are using precautions like <code>mysql_real_escape_string()</code> to cover most of vulnerable inputs. We are passing id of the product through query string and it makes the command as:</p>
  
  <pre><code>$id = mysql_real_escape_string($_REQUEST['id']);
  $qry = "Select * from products where id = ".$id;
  </code></pre>
  
  <p>but hacker tried to provide input as</p>
  
  <pre><code>?id=3 and sleep(4)
  </code></pre>
  
  <p>and query becomes</p>
  
  <pre><code>Select * from products where id = 3 and sleep(4);
  </code></pre>
  
  <p>Although there are some possible solutions like</p>
  
  <ol>
  <li>Check if the product id is numeric or not</li>
  <li>Remove word sleep from input using some customized function</li>
  </ol>
  
  <p>Is there any other method to stop this? What is the best method to prevent sleep injections?</p>